bullmq
Queue for messages and jobs based on Redis
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Publisher moved to GitHub Actions CI/CD with SLSA provenance; expected for automated semantic-release workflow. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Active package with frequent feature additions; 21 new source files consistent with normal development cadence and SLSA provenance confirms CI build integrity. | ai | |
| provenance | no-provenance | AI (provenance): Established package with strong ecosystem trust; provenance absence is common and not indicative of risk. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): bullmq is a major, actively maintained package (714 versions, 4.5M weekly downloads). Dormancy signal is a false positive given SLSA provenance attestation confirming CI/CD publication and no other risk signals. | ai | |
| dependencies | unvetted-dep:node-abort-controller | AI (dependencies): node-abort-controller is a legitimate AbortController polyfill; its use in bullmq is appropriate for Node.js >=12 compatibility and is a stable, expected dependency. | ai |
Versions (showing 10 of 110)
| Version | Deps | Published |
|---|---|---|
| 5.53.2 | 7 / 56 | |
| 5.53.1 | 7 / 56 | |
| 5.53.0 | 7 / 56 | |
| 5.52.3 | 7 / 56 | |
| 5.52.2 | 7 / 56 | |
| 5.52.1 | 7 / 56 | |
| 5.52.0 | 7 / 56 | |
| 5.51.1 | 7 / 56 | |
| 5.51.0 | 7 / 56 | |
| 5.50.0 | 7 / 56 |
v5.53.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.53.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.53.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.52.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.52.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.52.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.52.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.51.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.51.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.50.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.