immer
Create your next immutable state by mutating the current one
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Publisher change from mweststrate to aleclarson is a documented, legitimate maintainer transition for the immer project. aleclarson has a strong track record (33 approved packages, 2736 days on npm). | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): aleclarson is a known, legitimate contributor added as maintainer during the documented immer project transition. No malicious indicators present. | ai | |
| provenance | missing-githead | AI (provenance): Early version (0.2.0) published by the original author mweststrate before consistent gitHead tracking; no supply chain concern given publisher reputation and clean package contents. | ai | |
| provenance | no-provenance | AI (provenance): Package predates Sigstore provenance; already marked as accepted risk in findings. | ai | |
| source-diff | obfuscated-file:dist/cjs/immer.cjs.production.js | AI (source-diff): Standard minified production build artifact for immer; contains recognizable immer internals and API exports. Minification is expected for this library's dist output. | ai | |
| source-diff | obfuscated-file:dist/immer.production.mjs | AI (source-diff): Standard minified ESM production build artifact for immer; same rationale as the CJS production build — expected dist output, not obfuscation. | ai |
Versions (showing 100 of 136)
| Version | Deps | Published |
|---|---|---|
| 11.1.8 | 0 / 23 | |
| 11.1.7 | 0 / 23 | |
| 11.1.6 | 0 / 23 | |
| 11.1.5 | 0 / 23 | |
| 11.1.4 | 0 / 23 | |
| 11.1.3 | 0 / 23 | |
| 11.1.2 | 0 / 22 | |
| 11.1.0 | 0 / 22 | |
| 11.0.1 | 0 / 22 | |
| 11.0.0 | 0 / 22 | |
| 10.2.0 | 0 / 22 | |
| 10.1.3 | 0 / 21 | |
| 10.1.2 | 0 / 21 | |
| 10.1.1 | 0 / 21 | |
| 10.1.0 | 0 / 21 | |
| 10.0.4 | 0 / 21 | |
| 10.0.3 | 0 / 22 | |
| 10.0.2 | 0 / 22 | |
| 10.0.1 | 0 / 22 | |
| 10.0.0 | 0 / 22 | |
| 9.0.21 | 0 / 23 | |
| 9.0.20 | 0 / 23 | |
| 9.0.19 | 0 / 23 | |
| 9.0.18 | 0 / 24 | |
| 9.0.17 | 0 / 23 | |
| 9.0.16 | 0 / 23 | |
| 9.0.15 | 0 / 23 | |
| 9.0.14 | 0 / 23 | |
| 9.0.13 | 0 / 23 | |
| 9.0.12 | 0 / 23 | |
| 9.0.11 | 0 / 23 | |
| 9.0.10 | 0 / 23 | |
| 9.0.9 | 0 / 23 | |
| 9.0.8 | 0 / 23 | |
| 9.0.7 | 0 / 23 | |
| 9.0.6 | 0 / 23 | |
| 6.0.9 | 0 / 26 | |
| 6.0.8 | 0 / 26 | |
| 6.0.7 | 0 / 26 | |
| 6.0.6 | 0 / 26 | |
| 6.0.5 | 0 / 26 | |
| 6.0.4 | 0 / 26 | |
| 6.0.3 | 0 / 26 | |
| 6.0.2 | 0 / 26 | |
| 6.0.1 | 0 / 26 | |
| 6.0.0 | 0 / 26 | |
| 5.3.6 | 0 / 32 | |
| 5.3.5 | 0 / 32 | |
| 5.3.4 | 0 / 32 | |
| 5.3.3 | 0 / 31 | |
| 5.3.2 | 0 / 31 | |
| 5.3.0 | 0 / 31 | |
| 5.2.1 | 0 / 30 | |
| 5.2.0 | 0 / 30 | |
| 5.1.0 | 0 / 30 | |
| 5.0.2 | 0 / 28 | |
| 5.0.1 | 0 / 28 | |
| 5.0.0 | 0 / 28 | |
| 4.0.2 | 0 / 28 | |
| 4.0.1 | 0 / 28 | |
| 4.0.0 | 0 / 28 | |
| 3.3.0 | 0 / 28 | |
| 3.2.1 | 0 / 28 | |
| 3.2.0 | 0 / 28 | |
| 3.1.4 | 0 / 28 | |
| 3.1.3 | 0 / 28 | |
| 3.1.2 | 0 / 28 | |
| 3.1.1 | 0 / 28 | |
| 3.0.0 | 0 / 28 | |
| 2.1.5 | 0 / 27 | |
| 2.1.4 | 0 / 26 | |
| 2.1.3 | 0 / 26 | |
| 2.1.2 | 0 / 26 | |
| 2.1.1 | 0 / 32 | |
| 2.1.0 | 0 / 32 | |
| 2.0.0 | 0 / 32 | |
| 1.12.1 | 0 / 32 | |
| 1.12.0 | 0 / 32 | |
| 1.11.1 | 0 / 32 | |
| 1.11.0 | 0 / 32 | |
| 1.10.5 | 0 / 32 | |
| 1.10.4 | 0 / 32 | |
| 1.10.3 | 0 / 32 | |
| 1.10.2 | 0 / 32 | |
| 1.10.1 | 0 / 32 | |
| 1.10.0 | 0 / 32 | |
| 1.9.3 | 0 / 32 | |
| 1.9.2 | 0 / 32 | |
| 1.9.1 | 0 / 32 | |
| 1.9.0 | 0 / 32 | |
| 1.8.2 | 0 / 33 | |
| 1.8.1 | 0 / 33 | |
| 1.8.0 | 0 / 34 | |
| 1.7.4 | 0 / 34 | |
| 1.7.3 | 0 / 34 | |
| 1.7.2 | 0 / 34 | |
| 1.7.1 | 0 / 34 | |
| 1.7.0 | 0 / 34 | |
| 1.6.0 | 0 / 34 | |
| 1.5.0 | 0 / 34 |
v11.1.8
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v11.1.7
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v11.1.6
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v11.1.5
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
[Accepted risk] This version was published by a different npm account than previous versions on 2026-05-04. This could indicate a legitimate maintainer transition or an account compromise.
v9.0.21
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.0.20
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.0.19
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.0.18
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.0.17
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.0.16
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.0.15
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.0.14
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.0.13
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.0.12
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.0.11
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.0.10
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.0.9
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.0.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.0.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.0.9
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.0.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.0.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.0.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.0.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.0.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.0.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.0.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.3.6
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2020-02-12. This could indicate a legitimate maintainer transition or an account compromise.
v5.3.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.3.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.3.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.3.2
3 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: mweststrate.
[Accepted risk] This version was published by a different npm account than previous versions on 2020-01-15. This could indicate a legitimate maintainer transition or an account compromise.
v5.3.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.2.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.2.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.0.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.3.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.2.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.2.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.1.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.1.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.1.2
2 findingsThis version was published by a different npm account than previous versions on 2019-05-14. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.1.1
2 findingsThis version was published by a different npm account than previous versions on 2019-04-18. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.0
2 findingsThis version was published by a different npm account than previous versions on 2019-04-17. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.5
2 findingsThis version was published by a different npm account than previous versions on 2019-04-04. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.4
2 findingsThis version was published by a different npm account than previous versions on 2019-03-19. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.3
2 findingsThis version was published by a different npm account than previous versions on 2019-03-13. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.2
2 findingsThis version was published by a different npm account than previous versions on 2019-03-12. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.1
2 findingsThis version was published by a different npm account than previous versions on 2019-03-05. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.0
2 findingsThis version was published by a different npm account than previous versions on 2019-02-28. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.0
2 findingsThis version was published by a different npm account than previous versions on 2019-02-02. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.12.1
2 findingsThis version was published by a different npm account than previous versions on 2019-01-23. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.12.0
2 findingsThis version was published by a different npm account than previous versions on 2019-01-22. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.1
2 findingsThis version was published by a different npm account than previous versions on 2019-01-22. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.0
2 findingsThis version was published by a different npm account than previous versions on 2019-01-21. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.10.5
2 findingsThis version was published by a different npm account than previous versions on 2019-01-14. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.10.4
2 findingsThis version was published by a different npm account than previous versions on 2019-01-12. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.10.3
2 findingsThis version was published by a different npm account than previous versions on 2019-01-12. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.10.2
2 findingsThis version was published by a different npm account than previous versions on 2019-01-12. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.10.1
2 findingsThis version was published by a different npm account than previous versions on 2019-01-11. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.10.0
2 findingsThis version was published by a different npm account than previous versions on 2019-01-04. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.9.3
2 findingsThis version was published by a different npm account than previous versions on 2018-12-18. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.9.2
2 findingsThis version was published by a different npm account than previous versions on 2018-12-16. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.9.1
2 findingsThis version was published by a different npm account than previous versions on 2018-12-16. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.9.0
2 findingsThis version was published by a different npm account than previous versions on 2018-12-15. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.8.2
2 findingsThis version was published by a different npm account than previous versions on 2018-12-12. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.8.1
2 findingsThis version was published by a different npm account than previous versions on 2018-12-12. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.8.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.7.4
2 findingsThis version was published by a different npm account than previous versions on 2018-10-28. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.7.3
2 findingsThis version was published by a different npm account than previous versions on 2018-10-25. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.7.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.7.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.7.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.6.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.5.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: mweststrate.