@vtex/cli-plugin-edition

Supply chain provenance

Status for the latest visible version.

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

Keywords

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
dependencies	unvetted-dep:@tiagonapoli/oclif-plugin-spaced-commands	AI (dependencies): VTEX-internal oclif plugin used across the CLI plugin suite; stable pattern for this package family.	ai	2026/05/18
npm-metadata	url-dep:nodemon-notifier-cli	AI (npm-metadata): Dev-only dependency not included in published files; no runtime risk.	ai	2026/05/18
phantom-deps	phantom-dep:ramda	AI (phantom-deps): Listed as runtime dep; phantom-dep heuristic false positive for this package.	ai	2026/05/18
phantom-deps	phantom-dep:tslib	AI (phantom-deps): Known implicit TypeScript runtime dep; stable false positive.	ai	2026/05/18
phantom-deps	phantom-dep:@oclif/config	AI (phantom-deps): Referenced in oclif config; stable false positive for oclif plugins.	ai	2026/05/18
phantom-deps	phantom-dep:@oclif/command	AI (phantom-deps): Referenced in oclif config; stable false positive for oclif plugins.	ai	2026/05/18
phantom-deps	phantom-dep:@tiagonapoli/oclif-plugin-spaced-commands	AI (phantom-deps): Referenced in oclif config only; stable false positive for this plugin.	ai	2026/05/18

Version	Deps	Published
0.1.1	5 / 18	2021-03-30