@strapi/provider-email-sendmail
Sendmail provider for strapi email
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| maintainer-change | maintainer-added | AI (maintainer-change): Strapi org regularly adds maintainers; consistent with team growth in a large monorepo. | ai | |
| dependencies | unvetted-dep:sendmail | AI (dependencies): sendmail is the expected runtime dependency for this email provider plugin; its use is documented and intentional across all versions of this Strapi package. | ai | |
| license | uncommon-license:SEE LICENSE IN LICENSE | AI (license): Standard Strapi license declaration style used consistently across all @strapi/* packages in the monorepo. | ai | |
| phantom-deps | phantom-dep:@strapi/utils | AI (phantom-deps): @strapi/utils is a first-party Strapi dependency at the same monorepo version; phantom detection is a false positive for this package structure. | ai | |
| provenance | no-provenance | AI (provenance): Strapi's publishing pipeline does not currently use Sigstore provenance; consistent across all 2283+ versions of this package family. | ai |
Versions (showing 12 of 112)
| Version | Deps | Published |
|---|---|---|
| 5.1.1 | 2 / 4 | |
| 5.1.0 | 2 / 4 | |
| 5.0.6 | 2 / 4 | |
| 5.0.5 | 2 / 4 | |
| 5.0.4 | 2 / 4 | |
| 5.0.3 | 2 / 4 | |
| 5.0.2 | 2 / 4 | |
| 5.0.1 | 2 / 4 | |
| 5.0.0 | 2 / 4 | |
| 4.26.2 | 2 / 4 | |
| 4.26.1 | 2 / 4 | |
| 4.26.0 | 2 / 4 |
v5.1.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.1.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.