@tryghost/kg-lexical-html-renderer
Renders a lexical editor state string to a HTML string.
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): CI/CD migration with SLSA provenance, matches TryGhost's official automated release flow. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Expected fallout of switching to automated GitHub Actions publishing. | ai | |
| provenance | missing-githead | AI (provenance): CI-published monorepo package; gitHead gaps are publish-tooling noise, not compromise signal. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): Added dep is first-party @tryghost/kg-utils sibling package, not third-party. | ai | |
| phantom-deps | phantom-dep:@lexical/code | AI (phantom-deps): Declared runtime dep used transitively via lexical ecosystem; phantom-dep heuristic false positive for this package. | ai | |
| phantom-deps | phantom-dep:@lexical/clipboard | AI (phantom-deps): Declared runtime dep used transitively via lexical ecosystem; phantom-dep heuristic false positive for this package. | ai |
Versions (showing 51 of 83)
| Version | Deps | Published |
|---|---|---|
| 1.4.5 | 11 / 0 | |
| 1.4.4 | 11 / 8 | |
| 1.4.3 | 10 / 14 | |
| 1.4.2 | 10 / 14 | |
| 1.4.1 | 10 / 14 | |
| 1.4.0 | 10 / 14 | |
| 1.3.44 | 10 / 6 | |
| 1.3.43 | 10 / 6 | |
| 1.3.42 | 10 / 6 | |
| 1.3.41 | 10 / 6 | |
| 1.3.40 | 10 / 6 | |
| 1.3.39 | 10 / 6 | |
| 1.3.38 | 10 / 6 | |
| 1.3.37 | 10 / 6 | |
| 1.3.36 | 10 / 6 | |
| 1.3.35 | 10 / 6 | |
| 1.3.34 | 10 / 6 | |
| 1.3.33 | 10 / 6 | |
| 1.3.32 | 10 / 6 | |
| 1.3.31 | 10 / 6 | |
| 1.3.30 | 10 / 6 | |
| 1.3.29 | 10 / 6 | |
| 1.3.28 | 10 / 6 | |
| 1.3.27 | 10 / 6 | |
| 1.3.25 | 10 / 5 | |
| 1.3.24 | 10 / 6 | |
| 1.3.23 | 10 / 6 | |
| 1.3.22 | 10 / 6 | |
| 1.3.21 | 10 / 6 | |
| 1.3.20 | 10 / 6 | |
| 1.3.19 | 10 / 6 | |
| 1.3.18 | 10 / 6 | |
| 1.3.17 | 10 / 6 | |
| 1.3.16 | 10 / 6 | |
| 1.3.15 | 10 / 6 | |
| 1.3.14 | 10 / 6 | |
| 1.3.13 | 10 / 6 | |
| 1.3.12 | 10 / 6 | |
| 1.3.11 | 10 / 6 | |
| 1.3.10 | 10 / 6 | |
| 1.3.9 | 10 / 6 | |
| 1.3.8 | 10 / 6 | |
| 1.3.7 | 10 / 6 | |
| 1.3.5 | 10 / 6 | |
| 1.3.4 | 10 / 6 | |
| 1.3.3 | 10 / 6 | |
| 1.3.2 | 10 / 6 | |
| 1.3.1 | 10 / 6 | |
| 1.3.0 | 10 / 6 | |
| 1.2.2 | 10 / 6 | |
| 1.2.1 | 10 / 6 |
v1.4.5
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
v1.4.4
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.3.42
2 findingsThis version was published by a different npm account than previous versions on 2026-03-24. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.3.41
2 findingsThis version was published by a different npm account than previous versions on 2026-03-23. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.3.40
2 findingsThis version was published by a different npm account than previous versions on 2026-03-22. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.3.39
2 findingsThis version was published by a different npm account than previous versions on 2026-03-20. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.3.38
2 findingsThis version was published by a different npm account than previous versions on 2026-03-16. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.3.37
2 findingsThis version was published by a different npm account than previous versions on 2026-03-12. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.3.36
2 findingsThis version was published by a different npm account than previous versions on 2026-03-02. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.3.35
2 findingsThis version was published by a different npm account than previous versions on 2026-02-26. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.3.34
2 findingsThis version was published by a different npm account than previous versions on 2026-02-25. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.3.33
2 findingsThis version was published by a different npm account than previous versions on 2026-02-23. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.3.32
2 findingsThis version was published by a different npm account than previous versions on 2026-02-05. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.3.31
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (chrisraible) than the most recent previously approved version (allouis) on 2026-01-27, but chrisraible is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.3.30
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (kevinansfield) than the most recent previously approved version (tmciesco) on 2026-01-27, but kevinansfield is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.3.29
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (tmciesco) than the most recent previously approved version (chrisraible) on 2026-01-22, but tmciesco is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.3.28
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (chrisraible) than the most recent previously approved version (vershwal) on 2026-01-15, but chrisraible is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.3.27
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (vershwal) than the most recent previously approved version (allouis) on 2026-01-05, but vershwal is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.3.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.1
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (kevinansfield) than the most recent previously approved version (daniellockyer) on 2025-03-03, but kevinansfield is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.3.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (daniellockyer) than the most recent previously approved version (ronaldlangeveld) on 2025-02-17, but daniellockyer is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.2.2
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (ronaldlangeveld) than the most recent previously approved version (kevinansfield) on 2025-02-13, but ronaldlangeveld is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.2.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.