@teambit/global-config
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@teambit/legacy.global-config | AI (dependencies): First-party @teambit monorepo sibling package, part of normal Harmony refactor. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): New deps are all official @teambit sibling packages, not external supply-chain risk. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Long-established teambit org package; removal of learn-bit without new additions is consistent with routine org maintenance. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Established monorepo package; missing description is stable pattern. | ai | |
| provenance | no-provenance | AI (provenance): Only ~12% of npm has provenance; not a disqualifier for established packages. | ai | |
| dependencies | unvetted-dep:@teambit/scope.remotes | AI (dependencies): Sibling @teambit monorepo package; unvetted status is a pipeline artifact, not a risk signal. | ai | |
| dependencies | unvetted-dep:@teambit/cli | AI (dependencies): Sibling @teambit monorepo package; unvetted status is a pipeline artifact, not a risk signal. | ai | |
| dependencies | unvetted-dep:@teambit/legacy.constants | AI (dependencies): Sibling @teambit monorepo package; unvetted status is a pipeline artifact, not a risk signal. | ai | |
| dependencies | unvetted-dep:@teambit/harmony | AI (dependencies): Sibling @teambit monorepo package; unvetted status is a pipeline artifact, not a risk signal. | ai | |
| dependencies | unvetted-dep:@teambit/bit-error | AI (dependencies): Sibling @teambit monorepo package; unvetted status is a pipeline artifact, not a risk signal. | ai | |
| dependencies | unvetted-dep:@teambit/config-store | AI (dependencies): Sibling @teambit monorepo package; unvetted status is a pipeline artifact, not a risk signal. | ai | |
| dependencies | unvetted-dep:@teambit/legacy.scope | AI (dependencies): Sibling @teambit monorepo package; unvetted status is a pipeline artifact, not a risk signal. | ai |
Versions (showing 33 of 233)
| Version | Deps | Published |
|---|---|---|
| 0.0.898 | 5 / 4 | |
| 0.0.897 | 5 / 4 | |
| 0.0.896 | 5 / 4 | |
| 0.0.895 | 5 / 4 | |
| 0.0.894 | 5 / 4 | |
| 0.0.893 | 5 / 4 | |
| 0.0.892 | 5 / 4 | |
| 0.0.891 | 5 / 4 | |
| 0.0.890 | 5 / 4 | |
| 0.0.889 | 5 / 4 | |
| 0.0.888 | 5 / 4 | |
| 0.0.887 | 5 / 4 | |
| 0.0.886 | 5 / 4 | |
| 0.0.885 | 5 / 4 | |
| 0.0.884 | 5 / 4 | |
| 0.0.883 | 5 / 4 | |
| 0.0.882 | 5 / 4 | |
| 0.0.881 | 5 / 4 | |
| 0.0.880 | 5 / 4 | |
| 0.0.879 | 5 / 4 | |
| 0.0.878 | 5 / 4 | |
| 0.0.877 | 5 / 4 | |
| 0.0.876 | 5 / 4 | |
| 0.0.875 | 5 / 4 | |
| 0.0.874 | 5 / 4 | |
| 0.0.873 | 5 / 4 | |
| 0.0.872 | 5 / 4 | |
| 0.0.871 | 5 / 4 | |
| 0.0.870 | 5 / 4 | |
| 0.0.869 | 5 / 4 | |
| 0.0.868 | 5 / 4 | |
| 0.0.867 | 5 / 4 | |
| 0.0.866 | 5 / 4 |
v0.0.898
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.897
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.896
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.895
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.894
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.893
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.892
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.891
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.890
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.889
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.888
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.887
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.886
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.885
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.884
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.883
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.882
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.881
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.880
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.879
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.878
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.877
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.876
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.875
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.874
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.873
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.872
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.871
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.870
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.869
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.868
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.867
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.866
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.