@apollo/client
A fully-featured caching GraphQL client.
47
Versions
MIT
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
phryneasjerelmillerapollo-botabernix
Keywords
apollographqlreacthooksclientcachetanstack-intent
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:apollo-link | AI (dependencies): apollo-link is a well-known Apollo ecosystem package; its presence as a dependency of @apollo/client is expected and legitimate across all versions. | ai | |
| phantom-deps | phantom-dep:zen-observable | AI (phantom-deps): zen-observable is a direct runtime dependency in package.json; the phantom-dep flag is a false positive caused by config-file references rather than direct imports in source. | ai | |
| dependencies | unvetted-peer-dep:rxjs | AI (dependencies): rxjs is a foundational peer dependency for Apollo Client; widely vetted in practice despite analyzer status. | ai | |
| provenance | slsa-provenance | AI (provenance): SLSA provenance attestation is the strongest supply chain integrity signal; stable for this package's CI/CD pipeline. | ai | |
| phantom-deps | phantom-dep:npm | AI (phantom-deps): npm referenced in config files but not directly imported; expected pattern for build tools. | ai | |
| dependencies | unvetted-dep:npm | AI (dependencies): npm is a standard build tool; unvetted status is expected and acceptable for this package. | ai | |
| provenance | missing-githead | AI (provenance): Missing gitHead is metadata drift, not a security issue; Apollo's publisher history is strong. | ai | |
| dependencies | unvetted-dep:optimism | AI (dependencies): Apollo ecosystem dependency with reasonable version constraint; stable for this package. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Large new source files are expected for library update; no evidence of injected code. | ai | |
| phantom-deps | phantom-dep:response-iterator | AI (phantom-deps): Declared dependency referenced in config files; normal for build tooling. | ai | |
| dependencies | unvetted-dep:@graphql-typed-document-node/core | AI (dependencies): Apollo ecosystem dependency with reasonable version constraint; stable for this package. | ai | |
| dependencies | unvetted-dep:zen-observable-ts | AI (dependencies): Apollo ecosystem dependency with reasonable version constraint; stable for this package. | ai | |
| dependencies | unvetted-dep:response-iterator | AI (dependencies): Apollo ecosystem dependency with reasonable version constraint; stable for this package. | ai | |
| dependencies | unvetted-dep:@wry/trie | AI (dependencies): Apollo ecosystem dependency with reasonable version constraint; stable for this package. | ai | |
| publish-pattern | suspicious-version-number | AI (publish-pattern): Pre-release version from CI/CD (PR-based versioning); pattern is legitimate for this package's release workflow. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): New dependencies are Apollo ecosystem packages; legitimate library update. | ai | |
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Reflect.get() in test code is legitimate testing pattern, not obfuscation; stable for this package. | ai | |
| dependencies | unvetted-peer-dep:subscriptions-transport-ws | AI (dependencies): subscriptions-transport-ws is a legacy but standard GraphQL subscription transport; optional peer dependency. | ai | |
| dependencies | unvetted-peer-dep:react-dom | AI (dependencies): react-dom is a standard peer dependency for React libraries; no security concern. | ai | |
| dependencies | unvetted-peer-dep:graphql-ws | AI (dependencies): graphql-ws is a standard GraphQL subscription transport; optional peer dependency with no risk. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher change to GitHub Actions reflects Apollo's CI/CD automation; SLSA provenance attestation validates the transition. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): Maintainer additions to established Apollo project; legitimate team expansion, not account compromise. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): benjamn's removal is part of normal maintainer rotation; combined with new maintainer and SLSA provenance, no takeover risk. | ai | |
| provenance | no-provenance | AI (provenance): Provenance attestation not yet enabled; not a security defect for this mature package. | ai | |
| dependencies | unvetted-dep:use-sync-external-store | AI (dependencies): Established React utility; single new dependency addition is benign. | ai | |
| phantom-deps | phantom-dep:@types/use-sync-external-store | AI (phantom-deps): Framework-scoped type package loaded by convention; stable for this package. | ai | |
| dependencies | unvetted-dep:@types/use-sync-external-store | AI (dependencies): Type definitions for React hook; framework-scoped package, stable for this package. | ai | |
| phantom-deps | phantom-dep:@types/zen-observable | AI (phantom-deps): Framework-scoped type package; expected and benign for TypeScript support. | ai | |
| dependencies | unvetted-dep:fast-json-stable-stringify | AI (dependencies): Standard Apollo Client dependency; vetted across 686 prior versions. | ai | |
| dependencies | unvetted-dep:zen-observable | AI (dependencies): Standard Apollo Client dependency; vetted across 686 prior versions. | ai | |
| phantom-deps | phantom-dep:terser | AI (phantom-deps): terser is referenced in build config files as a minifier tool, not a runtime import — expected pattern for this package. | ai | |
| dependencies | unvetted-dep:terser | AI (dependencies): terser is a well-known JS minifier used as a build tool by Apollo Client; no security concern. | ai |