apollo-cache-inmemory
Core abstract of Caching layer for Apollo Client
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | no-provenance | AI (provenance): Legacy release predates Sigstore; not a risk signal for this package. | ai | |
| provenance | missing-githead | AI (provenance): Publish-env metadata gap on trusted official package; no behavioral change. | ai | |
| npm-metadata | url-dep:apollo-utilities | AI (npm-metadata): Monorepo workspace file: reference to sibling package; stable pattern. | ai | |
| npm-metadata | url-dep:apollo-cache | AI (npm-metadata): Monorepo workspace file: reference to sibling package; stable pattern. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): optimism is a legitimate Apollo runtime dep replacing graphql-anywhere. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): apollo-bot is the org's automation account; legitimate Apollo team handoff. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): mdg removal is part of documented Apollo maintainer transition. | ai | |
| dependencies | unvetted-dep:optimism | AI (dependencies): optimism is a well-known reactive computation library used throughout the Apollo ecosystem; not a suspicious dependency for this package. | ai | |
| dependencies | unvetted-dep:apollo-utilities | AI (dependencies): apollo-utilities is a first-party Apollo GraphQL package from the same monorepo; stable and expected dependency. | ai | |
| dependencies | unvetted-dep:apollo-cache | AI (dependencies): apollo-cache is a first-party Apollo GraphQL package from the same monorepo; stable and expected dependency. | ai |
Versions (showing 49 of 49)
| Version | Deps | Published |
|---|---|---|
| 1.6.6 | 5 / 0 | |
| 1.6.5 | 5 / 0 | |
| 1.6.3 | 5 / 0 | |
| 1.6.2 | 5 / 0 | |
| 1.6.1 | 5 / 0 | |
| 1.6.0 | 5 / 0 | |
| 1.5.1 | 5 / 0 | |
| 1.5.0 | 5 / 0 | |
| 1.4.3 | 4 / 0 | |
| 1.4.2 | 4 / 0 | |
| 1.4.1 | 3 / 0 | |
| 1.4.0 | 3 / 0 | |
| 1.3.12 | 3 / 0 | |
| 1.3.11 | 3 / 0 | |
| 1.3.10 | 3 / 0 | |
| 1.3.9 | 3 / 0 | |
| 1.3.8 | 3 / 0 | |
| 1.3.7 | 3 / 0 | |
| 1.3.6 | 3 / 0 | |
| 1.3.5 | 3 / 0 | |
| 1.3.4 | 3 / 0 | |
| 1.3.3 | 3 / 0 | |
| 1.3.2 | 3 / 0 | |
| 1.3.1 | 3 / 0 | |
| 1.3.0 | 3 / 0 | |
| 1.2.10 | 3 / 0 | |
| 1.2.9 | 3 / 0 | |
| 1.2.8 | 3 / 14 | |
| 1.2.7 | 3 / 14 | |
| 1.2.6 | 3 / 14 | |
| 1.2.5 | 3 / 14 | |
| 1.2.4 | 3 / 14 | |
| 1.2.3 | 3 / 14 | |
| 1.2.2 | 3 / 14 | |
| 1.2.1 | 3 / 14 | |
| 1.2.0 | 3 / 14 | |
| 1.1.12 | 3 / 14 | |
| 1.1.11 | 3 / 14 | |
| 1.1.10 | 3 / 14 | |
| 1.1.9 | 3 / 14 | |
| 1.1.8 | 3 / 14 | |
| 1.1.7 | 3 / 14 | |
| 1.1.5 | 3 / 14 | |
| 1.1.4 | 3 / 14 | |
| 1.1.3 | 3 / 14 | |
| 1.1.2 | 3 / 14 | |
| 1.1.1 | 3 / 14 | |
| 1.1.0 | 3 / 13 | |
| 1.0.0 | 3 / 13 |
v1.6.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.6.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.6.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.5.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.3
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (apollo-bot) than the most recent previously approved version (benjamn) on 2019-02-13, but apollo-bot is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.4.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.12
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.11
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (apollo-bot) than the most recent previously approved version (benjamn) on 2018-11-21, but apollo-bot is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.3.10
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.5
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: benjamn.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.4
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: benjamn.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.3
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: benjamn.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.3.1
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: benjamn.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (benjamn) than the most recent previously approved version (mdg) on 2018-10-01, but benjamn is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.3.0
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: benjamn.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (benjamn) than the most recent previously approved version (mdg) on 2018-09-28, but benjamn is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.2.10
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.2.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.2.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.2.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.2.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.2.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.2.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.2.3
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (mdg) than the most recent previously approved version (benjamn) on 2018-06-13, but mdg is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.2.2
2 findingsThis version was published by a different npm account (hwillson) than the most recent previously approved version (benjamn) on 2018-05-30. It has since remained available on npm for 2972 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.2.1
2 findingsThis version was published by a different npm account (benjamn) than the most recent previously approved version (jbaxleyiii) on 2018-05-04. It has since remained available on npm for 2997 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.2.0
2 findingsThis version was published by a different npm account (benjamn) than the most recent previously approved version (jbaxleyiii) on 2018-05-02. It has since remained available on npm for 3000 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.12
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (jbaxleyiii) than the most recent previously approved version (peggyrayzis) on 2018-03-26, but jbaxleyiii is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.1.11
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.10
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.8
2 findingsThis version was published by a different npm account (peggyrayzis) than the most recent previously approved version (jbaxleyiii) on 2018-02-14. It has since remained available on npm for 3076 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.