@vercel/flags-core
16
Versions
—
License
No
Install Scripts
Attested
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation (unverified)
npm registry signatures
No source commit
Maintainers
matheussmatt.strakavercel-release-botzeit-bot
Keywords
vercelflagsvercel flagsfeature flagsflags sdk
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Vercel migrated publishing from vercel-release-bot to GitHub Actions CI; SLSA attestation confirms supply chain integrity. | ai | |
| provenance | slsa-provenance | AI (provenance): SLSA provenance via Sigstore CI attestation; stable supply chain signal for this Vercel-org package. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): @vercel/oidc is a first-party Vercel package; addition is consistent with the package's purpose. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Internal Vercel scoped package; sparse metadata is a consistent pattern across their published packages, not a spam signal. | ai | |
| phantom-deps | phantom-dep:jose | AI (phantom-deps): jose is a declared runtime dependency in package.json; likely used indirectly via re-exports or internal modules not directly imported at top level. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Consistent with Vercel's internal package publishing pattern; not indicative of malice. | ai | |
| provenance | no-provenance | AI (provenance): Trusted publisher (vercel-release-bot) with strong track record; absence of provenance is not a risk here. | ai |
Versions (showing 16 of 16)
| Version | Deps | Published |
|---|---|---|
| 1.7.1 | 4 / 7 | |
| 1.7.0 | 4 / 7 | |
| 1.6.0 | 4 / 7 | |
| 1.5.2 | 4 / 7 | |
| 1.5.1 | 4 / 7 | |
| 1.5.0 | 4 / 7 | |
| 1.4.0 | 3 / 7 | |
| 1.3.1 | 3 / 7 | |
| 1.2.1 | 3 / 7 | |
| 1.2.0 | 3 / 7 | |
| 1.1.1 | 3 / 7 | |
| 1.1.0 | 3 / 8 | |
| 1.0.1 | 3 / 9 | |
| 1.0.0 | 3 / 9 | |
| 0.1.8 | 3 / 7 | |
| 0.1.7 | 3 / 7 |
v1.7.1
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.7.0
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.6.0
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.5.2
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.