semantic-release
Automated semver compliant package publishing
100
Versions
MIT
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
semantic-release-botgr2mtravi
Keywords
authorautomationchangelogmodulepackagepublishreleasesemverversion
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| maintainer-change | maintainer-removed | AI (maintainer-change): pvdlg removal is a historical cleanup; package published via GitHub Actions with SLSA provenance, no takeover indicators. | ai | |
| phantom-deps | phantom-dep:aggregate-error | AI (phantom-deps): ESM package uses dynamic imports; deps are legitimately used at runtime. | ai | |
| phantom-deps | phantom-dep:hosted-git-info | AI (phantom-deps): ESM package uses dynamic imports; deps are legitimately used at runtime. | ai | |
| phantom-deps | phantom-dep:import-from-esm | AI (phantom-deps): ESM package uses dynamic imports; deps are legitimately used at runtime. | ai | |
| phantom-deps | phantom-dep:marked-terminal | AI (phantom-deps): ESM package uses dynamic imports; deps are legitimately used at runtime. | ai | |
| phantom-deps | phantom-dep:read-package-up | AI (phantom-deps): ESM package uses dynamic imports; deps are legitimately used at runtime. | ai | |
| phantom-deps | phantom-dep:@semantic-release/error | AI (phantom-deps): ESM package uses dynamic imports; deps are legitimately used at runtime. | ai | |
| source-diff | source-size-dropped | AI (source-diff): Size drop likely reflects ESM refactoring/bundling changes, not code removal; no malicious indicators. | ai | |
| phantom-deps | phantom-dep:env-ci | AI (phantom-deps): ESM package uses dynamic imports; deps are legitimately used at runtime. | ai | |
| phantom-deps | phantom-dep:marked | AI (phantom-deps): ESM package uses dynamic imports; deps are legitimately used at runtime. | ai | |
| phantom-deps | phantom-dep:figures | AI (phantom-deps): ESM package uses dynamic imports; deps are legitimately used at runtime. | ai | |
| phantom-deps | phantom-dep:hook-std | AI (phantom-deps): ESM package uses dynamic imports; deps are legitimately used at runtime. | ai | |
| phantom-deps | phantom-dep:p-reduce | AI (phantom-deps): ESM package uses dynamic imports; deps are legitimately used at runtime. | ai | |
| phantom-deps | phantom-dep:get-stream | AI (phantom-deps): ESM package uses dynamic imports; deps are legitimately used at runtime. | ai | |
| phantom-deps | phantom-dep:micromatch | AI (phantom-deps): ESM package uses dynamic imports; deps are legitimately used at runtime. | ai | |
| phantom-deps | phantom-dep:cosmiconfig | AI (phantom-deps): ESM package uses dynamic imports; deps are legitimately used at runtime. | ai | |
| phantom-deps | phantom-dep:resolve-from | AI (phantom-deps): ESM package uses dynamic imports; deps are legitimately used at runtime. | ai | |
| phantom-deps | phantom-dep:p-each-series | AI (phantom-deps): ESM package uses dynamic imports; deps are legitimately used at runtime. | ai | |
| phantom-deps | phantom-dep:git-log-parser | AI (phantom-deps): ESM package uses dynamic imports; deps are legitimately used at runtime. | ai | |
| provenance | publisher-changed | AI (provenance): semantic-release migrated publishing to GitHub Actions CI/CD with SLSA provenance attestation; this publisher change is legitimate and verifiable for this package. | ai | |
| dependencies | unvetted-dep:figures | AI (dependencies): figures is a well-known sindresorhus terminal symbols utility; a legitimate, benign dependency for semantic-release's CLI output. | ai | |
| phantom-deps | phantom-dep:@semantic-release/commit-analyzer | AI (phantom-deps): Default plugin loaded dynamically at runtime. Stable false positive for this plugin-based architecture. | ai | |
| phantom-deps | phantom-dep:@semantic-release/npm | AI (phantom-deps): Default plugin loaded dynamically at runtime via resolve-from/import-from-esm; static import analysis cannot detect this pattern. Stable false positive for this package. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): semantic-release is CI/CD tooling that intentionally propagates process.env to child git processes. This is expected behavior, not a vulnerability, and is stable across all versions. | ai | |
| phantom-deps | phantom-dep:@semantic-release/release-notes-generator | AI (phantom-deps): Default plugin loaded dynamically at runtime. Stable false positive for this plugin-based architecture. | ai | |
| phantom-deps | phantom-dep:@semantic-release/github | AI (phantom-deps): Default plugin loaded dynamically at runtime. Same pattern as @semantic-release/npm — stable false positive. | ai |
Versions (showing 100 of 337)
| Version | Deps | Published |
|---|---|---|
| 17.1.0 | 28 / 18 | |
| 17.0.8 | 28 / 18 | |
| 17.0.7 | 28 / 18 | |
| 17.0.6 | 28 / 18 | |
| 17.0.5 | 28 / 18 | |
| 17.0.4 | 28 / 18 | |
| 17.0.3 | 28 / 18 | |
| 17.0.2 | 28 / 18 | |
| 17.0.1 | 28 / 18 | |
| 17.0.0 | 28 / 18 | |
| 16.0.4 | 28 / 18 | |
| 16.0.3 | 28 / 18 | |
| 16.0.2 | 28 / 18 | |
| 16.0.1 | 28 / 18 | |
| 16.0.0 | 28 / 18 | |
| 15.14.0 | 26 / 18 | |
| 15.13.32 | 26 / 18 | |
| 15.13.31 | 26 / 18 | |
| 15.13.30 | 26 / 18 | |
| 15.13.29 | 26 / 18 | |
| 15.13.28 | 26 / 18 | |
| 15.13.27 | 26 / 18 | |
| 15.13.26 | 26 / 18 | |
| 15.13.25 | 26 / 18 | |
| 15.13.24 | 26 / 18 | |
| 15.13.23 | 26 / 18 | |
| 15.13.22 | 26 / 18 | |
| 15.13.21 | 26 / 18 | |
| 15.13.20 | 26 / 20 | |
| 15.13.19 | 26 / 20 | |
| 15.13.18 | 26 / 20 | |
| 15.13.17 | 26 / 20 | |
| 15.13.16 | 26 / 20 | |
| 15.13.15 | 26 / 20 | |
| 15.13.14 | 26 / 20 | |
| 15.13.13 | 26 / 20 | |
| 15.13.12 | 26 / 20 | |
| 15.13.11 | 26 / 20 | |
| 15.13.10 | 26 / 20 | |
| 15.13.9 | 26 / 20 | |
| 15.13.8 | 26 / 20 | |
| 15.13.7 | 26 / 20 | |
| 15.13.6 | 26 / 20 | |
| 15.13.5 | 26 / 20 | |
| 15.13.4 | 26 / 20 | |
| 15.13.3 | 26 / 20 | |
| 15.13.2 | 26 / 20 | |
| 15.13.1 | 26 / 20 | |
| 15.13.0 | 26 / 20 | |
| 15.12.5 | 26 / 20 | |
| 15.12.4 | 26 / 20 | |
| 15.12.3 | 26 / 20 | |
| 15.12.2 | 26 / 20 | |
| 15.12.1 | 26 / 20 | |
| 15.12.0 | 26 / 20 | |
| 15.11.0 | 26 / 20 | |
| 15.10.8 | 26 / 20 | |
| 15.10.7 | 26 / 20 | |
| 15.10.6 | 26 / 20 | |
| 15.10.5 | 27 / 20 | |
| 15.10.4 | 27 / 20 | |
| 15.10.3 | 27 / 20 | |
| 15.10.2 | 27 / 20 | |
| 15.10.1 | 27 / 20 | |
| 15.10.0 | 27 / 20 | |
| 15.9.17 | 27 / 20 | |
| 15.9.16 | 27 / 20 | |
| 15.9.15 | 27 / 20 | |
| 15.9.14 | 27 / 20 | |
| 15.9.13 | 27 / 20 | |
| 15.9.12 | 27 / 20 | |
| 15.9.11 | 27 / 20 | |
| 15.9.10 | 27 / 20 | |
| 15.9.9 | 27 / 20 | |
| 15.9.8 | 27 / 19 | |
| 15.9.7 | 27 / 19 | |
| 15.9.6 | 27 / 19 | |
| 15.9.5 | 27 / 19 | |
| 15.9.4 | 27 / 19 | |
| 15.9.3 | 27 / 19 | |
| 15.9.2 | 27 / 19 | |
| 15.9.1 | 27 / 19 | |
| 15.9.0 | 27 / 19 | |
| 15.8.1 | 26 / 19 | |
| 15.8.0 | 26 / 19 | |
| 15.7.2 | 26 / 19 | |
| 15.7.1 | 26 / 19 | |
| 15.7.0 | 26 / 19 | |
| 15.6.6 | 26 / 19 | |
| 15.6.5 | 26 / 19 | |
| 15.6.4 | 26 / 19 | |
| 15.6.3 | 26 / 19 | |
| 15.6.2 | 26 / 19 | |
| 15.6.1 | 26 / 19 | |
| 15.6.0 | 26 / 19 | |
| 15.5.5 | 26 / 19 | |
| 15.5.4 | 26 / 19 | |
| 15.5.3 | 26 / 19 | |
| 15.5.2 | 26 / 19 | |
| 15.5.1 | 26 / 19 |
Showing 100 of 337
Next page →