git-semver-tags
Get all git semver tags of your repository in reverse chronological order.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:child-process-import | AI (semgrep): child_process.exec is core functionality — this package runs git commands to retrieve semver tags. Expected and stable for all versions. | ai | |
| provenance | publisher-changed | AI (provenance): dangreen is an established conventional-changelog ecosystem maintainer (599 approved packages, 430 days history) taking over from oss-bot automation. Transition is legitimate. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): dangreen is a known active maintainer of the conventional-changelog monorepo with strong track record. Addition is a legitimate maintainer transition. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Dormancy explained by transition from oss-bot automated releases to human maintainer dangreen. No code changes introduced; consistent with ecosystem maintenance pattern. | ai |
Versions (showing 32 of 32)
| Version | Deps | Published |
|---|---|---|
| 8.0.1 | 2 / 0 | |
| 8.0.0 | 2 / 0 | |
| 7.0.1 | 2 / 0 | |
| 7.0.0 | 2 / 0 | |
| 6.0.0 | 2 / 0 | |
| 5.0.1 | 2 / 0 | |
| 5.0.0 | 2 / 0 | |
| 4.1.1 | 2 / 0 | |
| 4.1.0 | 2 / 0 | |
| 4.0.0 | 2 / 0 | |
| 3.0.1 | 2 / 0 | |
| 3.0.0 | 2 / 0 | |
| 2.0.3 | 2 / 0 | |
| 2.0.2 | 2 / 0 | |
| 2.0.0 | 2 / 2 | |
| 1.3.6 | 2 / 2 | |
| 1.3.5 | 2 / 2 | |
| 1.3.4 | 2 / 2 | |
| 1.3.3 | 2 / 6 | |
| 1.3.2 | 2 / 6 | |
| 1.3.1 | 2 / 6 | |
| 1.3.0 | 2 / 6 | |
| 1.2.3 | 2 / 6 | |
| 1.2.2 | 2 / 6 | |
| 1.2.1 | 2 / 6 | |
| 1.2.0 | 2 / 6 | |
| 1.1.2 | 2 / 7 | |
| 1.1.1 | 2 / 7 | |
| 1.1.0 | 2 / 7 | |
| 1.0.0 | 2 / 6 | |
| 0.0.1 | 2 / 6 | |
| 0.0.0 | 2 / 6 |
v8.0.1
2 findingsThis version was published by a different npm account than previous versions on 2026-03-01. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.0.1
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: oss-bot.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.0.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: oss-bot.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.