@teambit/merge-lanes
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@teambit/legacy.utils | AI (dependencies): Internal same-org Bit monorepo dependency, not unvetted third-party code. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): New dep is first-party @teambit package within same monorepo/org. | ai | |
| dependencies | unvetted-dep:@teambit/harmony.modules.feature-toggle | AI (dependencies): Same @teambit org scope; consistent with this package's established dependency pattern. | ai | |
| dependencies | unvetted-dep:@teambit/legacy.cli.prompts | AI (dependencies): Same @teambit org scope; consistent with this package's established dependency pattern. | ai | |
| publish-pattern | rapid-publish | AI (publish-pattern): teambit uses automated CI/CD releasing many packages rapidly; consistent pattern across 2437+ versions. | ai | |
| dependencies | unvetted-dep:@teambit/legacy.scope | AI (dependencies): Same-org @teambit/* sibling package from the teambit/bit monorepo; stable pattern across versions. | ai | |
| dependencies | unvetted-dep:@teambit/legacy.bit-map | AI (dependencies): Same-org @teambit/* sibling package from the teambit/bit monorepo; stable pattern across versions. | ai | |
| dependencies | unvetted-dep:@teambit/legacy.constants | AI (dependencies): Same-org @teambit/* sibling package from the teambit/bit monorepo; stable pattern across versions. | ai | |
| dependencies | unvetted-dep:@teambit/component.snap-distance | AI (dependencies): Same-org @teambit/* sibling package from the teambit/bit monorepo; stable pattern across versions. | ai | |
| dependencies | unvetted-dep:@teambit/harmony.modules.get-basic-log | AI (dependencies): Same-org @teambit/* sibling package from the teambit/bit monorepo; stable pattern across versions. | ai | |
| dependencies | unvetted-dep:@teambit/component.modules.merge-helper | AI (dependencies): Same-org @teambit/* sibling package from the teambit/bit monorepo; stable pattern across versions. | ai | |
| dependencies | unvetted-dep:@teambit/legacy.consumer | AI (dependencies): Same-org @teambit/* sibling package from the teambit/bit monorepo; stable pattern across versions. | ai | |
| dependencies | unvetted-dep:@teambit/harmony | AI (dependencies): Same-org @teambit/* sibling package from the teambit/bit monorepo; stable pattern across versions. | ai | |
| dependencies | unvetted-dep:@teambit/lane-id | AI (dependencies): Same-org @teambit/* sibling package from the teambit/bit monorepo; stable pattern across versions. | ai | |
| dependencies | unvetted-dep:@teambit/bit-error | AI (dependencies): Same-org @teambit/* sibling package from the teambit/bit monorepo; stable pattern across versions. | ai | |
| dependencies | unvetted-dep:@teambit/component-id | AI (dependencies): Same-org @teambit/* sibling package from the teambit/bit monorepo; stable pattern across versions. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Bit ecosystem packages routinely omit npm descriptions; not a malware indicator here. | ai | |
| phantom-deps | phantom-dep:@teambit/component.snap-distance | AI (phantom-deps): Same-org sibling dep; phantom-dep heuristic unreliable for Bit's modular monorepo structure. | ai | |
| provenance | no-provenance | AI (provenance): Teambit publishes thousands of packages without Sigstore provenance; consistent across the ecosystem. | ai |
Versions (showing 100 of 401)
| Version | Deps | Published |
|---|---|---|
| 1.0.1096 | 32 / 4 | |
| 1.0.1095 | 32 / 4 | |
| 1.0.1093 | 31 / 4 | |
| 1.0.1091 | 31 / 4 | |
| 1.0.1090 | 31 / 4 | |
| 1.0.1089 | 31 / 4 | |
| 1.0.1088 | 31 / 4 | |
| 1.0.1087 | 31 / 4 | |
| 1.0.1085 | 31 / 4 | |
| 1.0.1084 | 31 / 4 | |
| 1.0.1083 | 31 / 4 | |
| 1.0.1080 | 31 / 4 | |
| 1.0.1079 | 31 / 4 | |
| 1.0.1076 | 31 / 4 | |
| 1.0.1073 | 31 / 4 | |
| 1.0.1072 | 31 / 4 | |
| 1.0.1071 | 31 / 4 | |
| 1.0.1070 | 31 / 4 | |
| 1.0.1069 | 31 / 4 | |
| 1.0.1068 | 31 / 4 | |
| 1.0.1066 | 31 / 4 | |
| 1.0.1065 | 31 / 4 | |
| 1.0.1064 | 31 / 4 | |
| 1.0.1063 | 31 / 4 | |
| 1.0.1062 | 31 / 4 | |
| 1.0.1060 | 31 / 4 | |
| 1.0.1059 | 31 / 4 | |
| 1.0.1058 | 31 / 4 | |
| 1.0.1057 | 31 / 4 | |
| 1.0.1056 | 31 / 4 | |
| 1.0.1055 | 31 / 4 | |
| 1.0.1052 | 31 / 4 | |
| 1.0.1051 | 31 / 4 | |
| 1.0.1050 | 31 / 4 | |
| 1.0.1049 | 31 / 4 | |
| 1.0.1048 | 31 / 4 | |
| 1.0.1047 | 31 / 4 | |
| 1.0.1040 | 31 / 4 | |
| 1.0.1025 | 31 / 4 | |
| 1.0.1014 | 31 / 4 | |
| 1.0.1006 | 31 / 4 | |
| 1.0.1000 | 31 / 4 | |
| 1.0.999 | 31 / 4 | |
| 1.0.998 | 31 / 4 | |
| 1.0.997 | 31 / 4 | |
| 1.0.996 | 31 / 4 | |
| 1.0.995 | 31 / 4 | |
| 1.0.994 | 31 / 4 | |
| 1.0.993 | 31 / 4 | |
| 1.0.988 | 31 / 4 | |
| 1.0.987 | 31 / 4 | |
| 1.0.986 | 31 / 4 | |
| 1.0.985 | 31 / 4 | |
| 1.0.984 | 31 / 4 | |
| 1.0.983 | 31 / 4 | |
| 1.0.982 | 31 / 4 | |
| 1.0.981 | 31 / 4 | |
| 1.0.980 | 31 / 4 | |
| 1.0.979 | 31 / 4 | |
| 1.0.978 | 31 / 4 | |
| 1.0.977 | 31 / 4 | |
| 1.0.976 | 31 / 4 | |
| 1.0.975 | 31 / 4 | |
| 1.0.974 | 31 / 4 | |
| 1.0.973 | 31 / 4 | |
| 1.0.972 | 31 / 4 | |
| 1.0.971 | 31 / 4 | |
| 1.0.970 | 31 / 4 | |
| 1.0.969 | 31 / 4 | |
| 1.0.968 | 31 / 4 | |
| 1.0.967 | 31 / 4 | |
| 1.0.966 | 31 / 4 | |
| 1.0.965 | 31 / 4 | |
| 1.0.964 | 31 / 4 | |
| 1.0.963 | 31 / 4 | |
| 1.0.962 | 31 / 4 | |
| 1.0.961 | 31 / 4 | |
| 1.0.960 | 31 / 4 | |
| 1.0.959 | 31 / 4 | |
| 1.0.958 | 31 / 4 | |
| 1.0.957 | 31 / 4 | |
| 1.0.956 | 31 / 4 | |
| 1.0.955 | 31 / 4 | |
| 1.0.954 | 31 / 4 | |
| 1.0.953 | 31 / 4 | |
| 1.0.951 | 31 / 4 | |
| 1.0.950 | 31 / 4 | |
| 1.0.949 | 31 / 4 | |
| 1.0.948 | 31 / 4 | |
| 1.0.947 | 31 / 4 | |
| 1.0.946 | 31 / 4 | |
| 1.0.945 | 31 / 4 | |
| 1.0.944 | 31 / 4 | |
| 1.0.942 | 31 / 4 | |
| 1.0.941 | 31 / 4 | |
| 1.0.940 | 31 / 4 | |
| 1.0.939 | 31 / 4 | |
| 1.0.792 | 31 / 4 | |
| 1.0.718 | 32 / 4 | |
| 1.0.638 | 32 / 4 |
v1.0.1096
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1095
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1093
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1091
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1090
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1089
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1088
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1087
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1085
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1084
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1083
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1080
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1079
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1076
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1073
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1072
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1071
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1070
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1069
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1068
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1066
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1065
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1064
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1063
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1062
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1060
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1059
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.