@wundergraph/composition No license 39 versions

@wundergraph/composition

npm Repository Homepage

39

Versions

—

License

No

Install Scripts

Verified

Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

gausiegmasgraspepolsuvijsuryadavidwgthisisnithinwilson.wundergraph

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
phantom-deps	phantom-dep:graphology-simple-path	AI (phantom-deps): Likely used via compiled dist output; no malicious behavior indicated.	ai	2026/07/25
phantom-deps	phantom-dep:vitest	AI (phantom-deps): Test-only dep referenced in config, not runtime code.	ai	2026/07/25
provenance	publisher-changed	AI (provenance): Migration to GitHub Actions CI/CD publishing with SLSA attestation; benign for this official package.	ai	2026/07/12
publish-pattern	new-deps-added	AI (publish-pattern): core-js is a well-known polyfill lib, benign addition.	ai	2026/07/12
maintainer-change	maintainer-added	AI (maintainer-change): Team roster change on active org repo with provenance intact; no compromise indicators.	ai	2026/07/12
maintainer-change	maintainer-removed	AI (maintainer-change): Consistent with normal team turnover, not takeover.	ai	2026/07/12
dependencies	unvetted-dep:set.prototype.isdisjointfrom	AI (dependencies): Well-known es-shims polyfill; stable, low-risk dependency.	ai	2026/05/18
dependencies	unvetted-dep:set.prototype.difference	AI (dependencies): Well-known es-shims polyfill; stable, low-risk dependency.	ai	2026/05/18
dependencies	unvetted-dep:set.prototype.intersection	AI (dependencies): Well-known es-shims polyfill; stable, low-risk dependency.	ai	2026/05/18
dependencies	unvetted-dep:set.prototype.issubsetof	AI (dependencies): Well-known es-shims polyfill; stable, low-risk dependency.	ai	2026/05/18
dependencies	unvetted-dep:set.prototype.issupersetof	AI (dependencies): Well-known es-shims polyfill; stable, low-risk dependency.	ai	2026/05/18
phantom-deps	phantom-dep:pathe	AI (phantom-deps): Declared in dependencies; used in config files. Stable false positive.	ai	2026/05/04
phantom-deps	phantom-dep:@graphql-tools/schema	AI (phantom-deps): Declared in dependencies; used in config files. Stable false positive.	ai	2026/05/04
phantom-deps	phantom-dep:@graphql-tools/utils	AI (phantom-deps): Declared in dependencies; used in config files. Stable false positive.	ai	2026/05/04

Versions (showing 39 of 139)

Version	Deps	Published
0.19.0	8 / 2	2024-03-11
0.18.5	8 / 2	2024-03-06
0.18.4	7 / 2	2024-02-27
0.18.3	7 / 2	2024-02-23
0.18.2	7 / 2	2024-02-20
0.18.1	7 / 2	2024-02-19
0.18.0	7 / 2	2024-02-05
0.17.1	7 / 2	2024-02-02
0.17.0	7 / 2	2024-01-30
0.16.0	7 / 2	2024-01-21
0.15.0	7 / 2	2024-01-09
0.14.0	7 / 2	2023-12-19
0.13.0	7 / 2	2023-12-15
0.12.2	7 / 2	2023-12-14
0.12.1	7 / 2	2023-12-13
0.12.0	7 / 2	2023-12-12
0.11.3	7 / 2	2023-11-29
0.11.2	7 / 2	2023-11-29
0.11.1	7 / 2	2023-11-28
0.11.0	7 / 2	2023-11-10
0.10.1	7 / 2	2023-10-26
0.10.0	7 / 2	2023-10-09
0.9.0	7 / 2	2023-09-26
0.8.1	7 / 2	2023-09-20
0.8.0	7 / 2	2023-09-19
0.7.1	7 / 2	2023-09-18
0.7.0	7 / 2	2023-09-15
0.6.2	7 / 2	2023-09-11
0.6.1	7 / 2	2023-09-08
0.6.0	7 / 2	2023-09-06
0.5.3	7 / 2	2023-08-31
0.5.2	7 / 2	2023-08-29
0.5.1	7 / 2	2023-08-28
0.5.0	7 / 2	2023-08-24
0.4.1	7 / 2	2023-08-24
0.4.0	7 / 2	2023-08-24
0.3.0	7 / 2	2023-08-24
0.2.0	7 / 2	2023-08-24
0.0.1	6 / 2	2023-08-04

v0.19.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.18.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.18.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.18.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.18.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.18.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.18.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.17.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.17.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.16.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.15.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.14.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.13.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.12.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.12.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.12.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.11.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.11.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.11.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.11.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.10.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.10.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.8.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.8.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.7.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.7.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.6.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.6.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.6.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.5.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.5.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.5.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.5.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.4.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.4.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.3.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.