← Home

@semantic-release/github

npm Repository Homepage

semantic-release plugin to publish a GitHub release and comment on released Pull Requests/Issues

100
Versions
MIT
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

pvdlgsemantic-release-botgr2mtravi

Keywords

gitgithubissuenotificationspublishpull-requestreleasesemantic-releaseversion

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance publisher-changed AI (provenance): semantic-release/github migrated from semantic-release-bot to GitHub Actions publishing with SLSA provenance. This is a legitimate, security-improving workflow change consistent with the org's CI/CD practices. ai
publish-pattern new-deps-added AI (publish-pattern): undici is the official Node.js HTTP client maintained by the Node.js core team; its addition to a GitHub API plugin is entirely reasonable and not a supply chain risk. ai

Versions (showing 100 of 166)

Version Deps Published
12.0.8 17 / 13
12.0.7 17 / 13
12.0.6 17 / 13
12.0.5 17 / 13
12.0.4 17 / 13
12.0.3 17 / 13
12.0.2 17 / 13
12.0.1 16 / 13
12.0.0 16 / 13
11.0.6 16 / 13
11.0.5 16 / 13
11.0.4 16 / 13
11.0.3 16 / 13
11.0.2 16 / 13
11.0.1 16 / 13
11.0.0 16 / 13
10.3.5 16 / 13
10.3.4 16 / 13
10.3.3 16 / 13
10.3.2 16 / 13
10.3.1 16 / 13
10.3.0 16 / 13
10.2.0 16 / 13
10.1.7 16 / 13
10.1.6 16 / 13
10.1.5 16 / 13
10.1.4 16 / 13
10.1.3 16 / 13
10.1.2 16 / 13
10.1.1 16 / 13
10.1.0 16 / 13
10.0.7 16 / 13
10.0.6 16 / 13
10.0.5 16 / 13
10.0.4 16 / 13
10.0.3 16 / 13
10.0.2 16 / 13
10.0.1 16 / 13
10.0.0 16 / 13
9.2.6 16 / 13
9.2.5 16 / 13
9.2.4 16 / 13
9.2.3 16 / 13
9.2.2 16 / 13
9.2.1 16 / 8
9.2.0 16 / 8
9.1.0 16 / 8
9.0.7 16 / 8
9.0.6 16 / 8
9.0.5 16 / 8
9.0.4 16 / 8
9.0.3 16 / 8
9.0.2 16 / 8
9.0.1 16 / 8
9.0.0 16 / 8
8.1.0 17 / 12
8.0.9 17 / 12
8.0.8 17 / 12
8.0.7 16 / 12
8.0.6 16 / 12
8.0.5 16 / 12
8.0.4 16 / 12
8.0.3 16 / 12
8.0.2 16 / 12
8.0.1 16 / 12
8.0.0 16 / 12
7.2.3 16 / 12
7.2.2 16 / 12
7.2.1 16 / 12
7.2.0 16 / 12
7.1.2 16 / 12
7.1.1 16 / 12
7.1.0 16 / 12
7.0.7 16 / 12
7.0.6 16 / 12
7.0.5 16 / 12
7.0.4 16 / 12
7.0.3 16 / 12
7.0.2 16 / 12
7.0.1 16 / 12
7.0.0 16 / 12
6.0.2 16 / 12
6.0.1 16 / 12
6.0.0 16 / 12
5.5.8 16 / 12
5.5.7 16 / 12
5.5.6 16 / 12
5.5.5 16 / 12
5.5.4 16 / 12
5.5.3 17 / 12
5.5.2 17 / 12
5.5.1 17 / 12
5.5.0 17 / 12
5.4.4 17 / 12
5.4.3 17 / 14
5.4.2 17 / 14
5.4.1 17 / 14
5.4.0 17 / 14
5.3.5 17 / 14
5.3.4 17 / 14
Showing 100 of 166 Next page →

v12.0.8

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v12.0.7

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v12.0.6

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v12.0.5

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v12.0.4

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v12.0.3

2 findings
HIGH Publisher changed: semantic-release-bot → GitHub Actions (on 2026-01-30) provenance

This version was published by a different npm account than previous versions on 2026-01-30. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v12.0.2

2 findings
HIGH Publisher changed: semantic-release-bot → GitHub Actions (on 2025-11-08) provenance

This version was published by a different npm account than previous versions on 2025-11-08. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v12.0.1

2 findings
HIGH Publisher changed: semantic-release-bot → GitHub Actions (on 2025-10-31) provenance

This version was published by a different npm account than previous versions on 2025-10-31. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v12.0.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.0.6

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.0.5

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.0.4

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.0.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.0.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.0.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.0.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.3.5

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.3.4

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.3.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.3.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.3.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.3.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.2.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.1.7

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.1.6

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.1.5

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.1.4

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.1.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.1.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.1.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.1.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.0.7

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.0.6

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.0.5

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.0.4

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.