@things-factory/warehouse-base
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:dynamic-require | AI (semgrep): Migration file loader pattern using local file paths; stable across versions of this monorepo package. | ai |
Versions (showing 75 of 75)
| Version | Deps | Published |
|---|---|---|
| 8.0.92 | 6 / 0 | |
| 8.0.90 | 6 / 0 | |
| 8.0.89 | 6 / 0 | |
| 8.0.88 | 6 / 0 | |
| 4.3.827 | 8 / 0 | |
| 4.3.825 | 8 / 0 | |
| 4.3.824 | 8 / 0 | |
| 4.3.823 | 8 / 0 | |
| 4.3.822 | 8 / 0 | |
| 4.3.789 | 8 / 0 | |
| 4.3.769 | 8 / 0 | |
| 4.3.743 | 8 / 0 | |
| 4.3.656 | 8 / 0 | |
| 4.3.652 | 8 / 0 | |
| 4.3.638 | 8 / 0 | |
| 4.3.626 | 8 / 0 | |
| 4.3.621 | 8 / 0 | |
| 4.3.617 | 8 / 0 | |
| 4.3.616 | 8 / 0 | |
| 4.3.614 | 8 / 0 | |
| 4.3.609 | 8 / 0 | |
| 4.3.603 | 8 / 0 | |
| 4.3.595 | 8 / 0 | |
| 4.3.593 | 8 / 0 | |
| 4.3.591 | 8 / 0 | |
| 4.3.588 | 8 / 0 | |
| 4.3.587 | 8 / 0 | |
| 4.3.582 | 8 / 0 | |
| 4.3.581 | 8 / 0 | |
| 4.3.567 | 8 / 0 | |
| 4.3.566 | 8 / 0 | |
| 4.3.563 | 8 / 0 | |
| 4.3.562 | 8 / 0 | |
| 4.3.558 | 8 / 0 | |
| 4.3.554 | 8 / 0 | |
| 4.3.551 | 8 / 0 | |
| 4.3.544 | 8 / 0 | |
| 4.3.541 | 8 / 0 | |
| 4.3.537 | 8 / 0 | |
| 4.3.536 | 8 / 0 | |
| 4.3.535 | 8 / 0 | |
| 4.3.534 | 8 / 0 | |
| 4.3.532 | 8 / 0 | |
| 4.3.531 | 8 / 0 | |
| 4.3.529 | 8 / 0 | |
| 4.3.527 | 8 / 0 | |
| 4.3.526 | 8 / 0 | |
| 4.3.525 | 8 / 0 | |
| 4.3.524 | 8 / 0 | |
| 4.3.520 | 8 / 0 | |
| 4.3.518 | 8 / 0 | |
| 4.3.516 | 8 / 0 | |
| 4.3.515 | 8 / 0 | |
| 4.3.514 | 8 / 0 | |
| 4.3.512 | 8 / 0 | |
| 4.3.511 | 8 / 0 | |
| 4.3.510 | 8 / 0 | |
| 4.3.509 | 8 / 0 | |
| 4.3.505 | 8 / 0 | |
| 4.3.503 | 8 / 0 | |
| 4.3.502 | 8 / 0 | |
| 4.3.501 | 8 / 0 | |
| 4.3.495 | 8 / 0 | |
| 4.3.494 | 8 / 0 | |
| 4.3.493 | 8 / 0 | |
| 4.3.492 | 8 / 0 | |
| 4.3.479 | 8 / 0 | |
| 4.3.475 | 8 / 0 | |
| 4.3.470 | 8 / 0 | |
| 4.3.468 | 8 / 0 | |
| 4.3.464 | 8 / 0 | |
| 4.3.461 | 8 / 0 | |
| 4.3.460 | 8 / 0 | |
| 4.3.459 | 8 / 0 | |
| 4.3.458 | 8 / 0 |
v4.3.626
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.621
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.617
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.616
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.614
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.609
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.603
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.595
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.593
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.591
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.588
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.587
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.582
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.581
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.567
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.566
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.563
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.562
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.558
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.554
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.551
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.544
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.541
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.537
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.536
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.535
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.534
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.532
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.531
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.529
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.527
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.526
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.525
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.524
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.520
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.518
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.516
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.515
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.514
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.512
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.511
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.510
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.509
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.505
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.503
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.502
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.501
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.495
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.494
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.493
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.492
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.479
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.475
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.470
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.468
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.464
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.461
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.460
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.459
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.3.458
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.