@apollo/client
A fully-featured caching GraphQL client.
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:apollo-link | AI (dependencies): apollo-link is a well-known Apollo ecosystem package; its presence as a dependency of @apollo/client is expected and legitimate across all versions. | ai | |
| phantom-deps | phantom-dep:zen-observable | AI (phantom-deps): zen-observable is a direct runtime dependency in package.json; the phantom-dep flag is a false positive caused by config-file references rather than direct imports in source. | ai | |
| dependencies | unvetted-peer-dep:rxjs | AI (dependencies): rxjs is a foundational peer dependency for Apollo Client; widely vetted in practice despite analyzer status. | ai | |
| provenance | slsa-provenance | AI (provenance): SLSA provenance attestation is the strongest supply chain integrity signal; stable for this package's CI/CD pipeline. | ai | |
| phantom-deps | phantom-dep:npm | AI (phantom-deps): npm referenced in config files but not directly imported; expected pattern for build tools. | ai | |
| dependencies | unvetted-dep:npm | AI (dependencies): npm is a standard build tool; unvetted status is expected and acceptable for this package. | ai | |
| provenance | missing-githead | AI (provenance): Missing gitHead is metadata drift, not a security issue; Apollo's publisher history is strong. | ai | |
| dependencies | unvetted-dep:optimism | AI (dependencies): Apollo ecosystem dependency with reasonable version constraint; stable for this package. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Large new source files are expected for library update; no evidence of injected code. | ai | |
| phantom-deps | phantom-dep:response-iterator | AI (phantom-deps): Declared dependency referenced in config files; normal for build tooling. | ai | |
| dependencies | unvetted-dep:@graphql-typed-document-node/core | AI (dependencies): Apollo ecosystem dependency with reasonable version constraint; stable for this package. | ai | |
| dependencies | unvetted-dep:zen-observable-ts | AI (dependencies): Apollo ecosystem dependency with reasonable version constraint; stable for this package. | ai | |
| dependencies | unvetted-dep:response-iterator | AI (dependencies): Apollo ecosystem dependency with reasonable version constraint; stable for this package. | ai | |
| dependencies | unvetted-dep:@wry/trie | AI (dependencies): Apollo ecosystem dependency with reasonable version constraint; stable for this package. | ai | |
| publish-pattern | suspicious-version-number | AI (publish-pattern): Pre-release version from CI/CD (PR-based versioning); pattern is legitimate for this package's release workflow. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): New dependencies are Apollo ecosystem packages; legitimate library update. | ai | |
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Reflect.get() in test code is legitimate testing pattern, not obfuscation; stable for this package. | ai | |
| dependencies | unvetted-peer-dep:subscriptions-transport-ws | AI (dependencies): subscriptions-transport-ws is a legacy but standard GraphQL subscription transport; optional peer dependency. | ai | |
| dependencies | unvetted-peer-dep:react-dom | AI (dependencies): react-dom is a standard peer dependency for React libraries; no security concern. | ai | |
| dependencies | unvetted-peer-dep:graphql-ws | AI (dependencies): graphql-ws is a standard GraphQL subscription transport; optional peer dependency with no risk. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher change to GitHub Actions reflects Apollo's CI/CD automation; SLSA provenance attestation validates the transition. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): Maintainer additions to established Apollo project; legitimate team expansion, not account compromise. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): benjamn's removal is part of normal maintainer rotation; combined with new maintainer and SLSA provenance, no takeover risk. | ai | |
| provenance | no-provenance | AI (provenance): Provenance attestation not yet enabled; not a security defect for this mature package. | ai | |
| dependencies | unvetted-dep:use-sync-external-store | AI (dependencies): Established React utility; single new dependency addition is benign. | ai | |
| phantom-deps | phantom-dep:@types/use-sync-external-store | AI (phantom-deps): Framework-scoped type package loaded by convention; stable for this package. | ai | |
| dependencies | unvetted-dep:@types/use-sync-external-store | AI (dependencies): Type definitions for React hook; framework-scoped package, stable for this package. | ai | |
| phantom-deps | phantom-dep:@types/zen-observable | AI (phantom-deps): Framework-scoped type package; expected and benign for TypeScript support. | ai | |
| dependencies | unvetted-dep:fast-json-stable-stringify | AI (dependencies): Standard Apollo Client dependency; vetted across 686 prior versions. | ai | |
| dependencies | unvetted-dep:zen-observable | AI (dependencies): Standard Apollo Client dependency; vetted across 686 prior versions. | ai | |
| phantom-deps | phantom-dep:terser | AI (phantom-deps): terser is referenced in build config files as a minifier tool, not a runtime import — expected pattern for this package. | ai | |
| dependencies | unvetted-dep:terser | AI (dependencies): terser is a well-known JS minifier used as a build tool by Apollo Client; no security concern. | ai |
Versions (showing 100 of 347)
v4.0.0-alpha.23
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.0.0-alpha.22
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.0.0-alpha.21
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.0.0-alpha.20
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.0.0-alpha.19
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.0.0-alpha.18
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.0.0-alpha.17
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.0.0-alpha.16
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.0.0-alpha.15
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.0.0-alpha.14
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.0.0-alpha.13
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.0.0-alpha.12
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.0.0-alpha.11
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.