← Home

mongodb

npm Repository Homepage

The official MongoDB driver for Node.js

100
Versions
Apache-2.0
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

dariakpdbx-node

Keywords

mongodbdriverofficial

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
maintainer-change maintainer-removed AI (maintainer-change): christkv is the original MongoDB driver author who has since transitioned out. Maintainer rotation is expected for this long-lived official MongoDB package. ai
provenance publisher-changed AI (provenance): daprahamian is a long-standing MongoDB org contributor (2980 days, 70 approved packages). Publisher transitions are expected for this official MongoDB package over its 8+ year lifespan. ai
semgrep semgrep:eval-usage AI (semgrep): eval() usage is in bundled test dependency deps/nodeunit/deps/json2.js — a legacy JSON polyfill. Not in the main driver code and not a supply-chain risk. ai
install-scripts install-script:install AI (install-scripts): The install script (node install.js) is a long-standing part of the mongodb package for native binding setup, not a new or suspicious addition. ai
semgrep semgrep:dynamic-require AI (semgrep): Dynamic require() is in deps/nodeunit test framework code, not in the main mongodb driver. Standard test runner pattern. ai
semgrep semgrep:new-function-constructor AI (semgrep): new Function() is in deps/nodeunit/deps/ejs.js, a bundled test template engine. Standard pattern for template compilation, not in production driver code. ai
semgrep semgrep:base64-decode AI (semgrep): Base64 decoding in SCRAM auth (salt handling) is standard cryptographic practice for a MongoDB driver; not a malicious payload indicator. ai
semgrep semgrep:hex-decode AI (semgrep): Hex decoding used for ObjectId comparison is standard driver functionality; not a malicious payload indicator. ai
semgrep semgrep:api-obfuscation-reflect AI (semgrep): Reflect.get/set used for generic options object cloning in encrypter.js — legitimate JavaScript pattern, not obfuscation. ai
semgrep semgrep:shady-links-raw-ip AI (semgrep): 169.254.169.254 is the Azure IMDS link-local address for managed identity token retrieval — standard Azure SDK pattern. ai
semgrep semgrep:child-process-spawn AI (semgrep): Spawns 'npm run build:dts' in prepare script for development builds only; benign build tooling. ai
semgrep semgrep:child-process-import AI (semgrep): etc/prepare.js uses child_process only to run npm build:dts when src/ exists — standard build tooling, not runtime code. ai
semgrep semgrep:silent-process-exec-var AI (semgrep): Same mongocryptd spawn as above; detached process is required for CSFLE daemon lifecycle management. ai
semgrep semgrep:silent-process-exec AI (semgrep): mongocryptd_manager.js spawns the MongoDB CSFLE daemon as a detached process — documented, expected behavior for client-side encryption support. ai

Versions (showing 100 of 143)

Hide prereleases
Version Deps Published
7.2.0 3 / 51
7.1.1 3 / 50
7.1.0 3 / 50
7.0.0 3 / 49
6.21.0 3 / 50
6.20.0 3 / 50
6.19.0 3 / 50
6.18.0 3 / 50
6.17.0 3 / 50
6.16.0 3 / 50
6.15.0 3 / 50
6.14.2 3 / 50
6.14.1 3 / 50
6.14.0 3 / 50
6.13.1 3 / 50
6.13.0 3 / 50
6.12.0 3 / 50
6.11.0 3 / 50
6.10.0 3 / 50
6.9.0 3 / 50
6.8.2 3 / 52
6.8.1 3 / 52
6.8.0 3 / 52
6.7.0 3 / 52
6.6.2 3 / 53
6.6.1 3 / 53
6.6.0 3 / 53
6.5.0 3 / 51
6.4.0 3 / 51
6.3.0 3 / 50
6.2.0 3 / 50
6.1.0 3 / 50
6.0.0 3 / 50
5.9.2 3 / 45
5.9.1 3 / 45
5.9.0 3 / 45
5.8.1 3 / 45
5.8.0 3 / 45
4.17.2 3 / 46
4.17.1 3 / 46
4.17.0 3 / 46
3.7.4 6 / 33
3.7.3 6 / 33
3.7.2 6 / 33
3.7.1 6 / 33
3.7.0 6 / 33
3.6.12 6 / 33
3.6.11 6 / 33
3.6.10 6 / 33
3.5.11 6 / 24
3.5.10 6 / 24
3.5.9 6 / 24
3.5.8 6 / 24
3.5.7 6 / 24
3.5.6 6 / 24
3.5.5 6 / 23
3.5.4 6 / 24
3.5.3 6 / 24
3.5.2 6 / 24
3.5.1 6 / 24
3.5.0 6 / 24
3.4.1 4 / 25
3.4.0 4 / 25
3.3.5 4 / 24
3.3.4 4 / 24
3.3.3 4 / 23
3.3.2 3 / 22
3.3.1 3 / 22
3.3.0 3 / 22
3.2.7 2 / 21
3.2.6 2 / 21
3.2.5 2 / 21
3.2.4 2 / 21
3.2.3 2 / 21
3.2.2 2 / 21
3.2.1 2 / 21
3.1.13 2 / 21
7.2.0-dev.20260421.sha.e8c5e659 3 / 51
7.1.0-dev.20260418.sha.dbdd9320 3 / 51
7.1.0-dev.20260416.sha.16a899da 3 / 51
7.1.0-dev.20260415.sha.1fc0e09f 3 / 51
7.1.0-dev.20260409.sha.1cf791f9 3 / 51
7.1.0-dev.20260331.sha.f36b7546 3 / 51
7.1.0-dev.20260327.sha.941e5fa3 3 / 51
7.1.0-dev.20260326.sha.5d414cc9 3 / 51
7.1.0-dev.20260324.sha.4c894082 3 / 50
7.1.0-dev.20260323.sha.f7ea4219 3 / 50
7.1.0-dev.20260321.sha.7be12ee8 3 / 50
7.1.0-dev.20260320.sha.778a2a14 3 / 50
7.1.0-dev.20260319.sha.0634c9b6 3 / 50
7.1.0-dev.20260317.sha.ac98f4a9 3 / 50
7.1.0-dev.20260314.sha.275afa5f 3 / 50
7.1.0-dev.20260311.sha.aa8b39cd 3 / 50
7.1.0-dev.20260310.sha.87a34653 3 / 50
7.1.0-dev.20260307.sha.a1c04e2b 3 / 50
7.1.0-dev.20260303.sha.4d6e2a2e 3 / 50
7.1.0-dev.20260228.sha.4dbcb887 3 / 50
7.1.0-dev.20260226.sha.22c6031a 3 / 50
7.1.0-dev.20260213.sha.e5a85d07 3 / 50
7.1.0-dev.20260211.sha.e465058c 3 / 50
Showing 100 of 143 Next page →

v7.1.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v7.1.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v7.0.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.21.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.20.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.19.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.18.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.17.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.16.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.15.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.14.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.14.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.14.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.13.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.13.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.12.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.11.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.10.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.9.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.8.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.8.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.8.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.7.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.6.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.6.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.6.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.5.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.4.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.3.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.2.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.1.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.0.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v5.9.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v5.9.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v5.9.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v5.8.1

2 findings
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

INFO Publisher changed: nbbeeken → dbx-node (on 2023-08-23) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2023-08-23. This could indicate a legitimate maintainer transition or an account compromise.

v5.8.0

2 findings
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

INFO Publisher changed: nbbeeken → dbx-node (on 2023-08-21) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2023-08-21. This could indicate a legitimate maintainer transition or an account compromise.

v4.17.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.17.1

2 findings
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

INFO Publisher changed: nbbeeken → dbx-node (on 2023-08-23) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2023-08-23. This could indicate a legitimate maintainer transition or an account compromise.

v4.17.0

2 findings
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

INFO Publisher changed: nbbeeken → dbx-node (on 2023-08-17) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2023-08-17. This could indicate a legitimate maintainer transition or an account compromise.

v3.7.4

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: nbbeeken → pearsb1 (on 2023-06-21) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2023-06-21. This could indicate a legitimate maintainer transition or an account compromise.

v3.7.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.7.2

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: nbbeeken → dariakp (on 2021-10-05) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2021-10-05. This could indicate a legitimate maintainer transition or an account compromise.

v3.7.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.7.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.6.12

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.6.11

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: mbroadst → nbbeeken (on 2021-08-05) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2021-08-05. This could indicate a legitimate maintainer transition or an account compromise.

v3.6.10

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: mbroadst → nbbeeken (on 2021-07-06) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2021-07-06. This could indicate a legitimate maintainer transition or an account compromise.

v3.5.11

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.5.10

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.5.9

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.5.8

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.5.7

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.5.6

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.5.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.5.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.5.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.5.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.5.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.5.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.4.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.4.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.3.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.3.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.3.3

2 findings
HIGH Publisher changed: mbroadst → daprahamian (on 2019-10-16) provenance

This version was published by a different npm account than previous versions on 2019-10-16. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.3.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.3.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.3.0

2 findings
HIGH Publisher changed: mbroadst → daprahamian (on 2019-08-13) provenance

This version was published by a different npm account than previous versions on 2019-08-13. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.2.7

2 findings
HIGH Publisher changed: mbroadst → daprahamian (on 2019-06-04) provenance

This version was published by a different npm account than previous versions on 2019-06-04. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.2.6

2 findings
HIGH Publisher changed: mbroadst → daprahamian (on 2019-05-24) provenance

This version was published by a different npm account than previous versions on 2019-05-24. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.2.5

2 findings
HIGH Publisher changed: mbroadst → daprahamian (on 2019-05-17) provenance

This version was published by a different npm account than previous versions on 2019-05-17. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.2.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.2.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.2.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.2.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.1.13

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.2.0-dev.20260421.sha.e8c5e659

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v7.1.0-dev.20260418.sha.dbdd9320

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v7.1.0-dev.20260416.sha.16a899da

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v7.1.0-dev.20260415.sha.1fc0e09f

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v7.1.0-dev.20260409.sha.1cf791f9

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v7.1.0-dev.20260331.sha.f36b7546

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v7.1.0-dev.20260327.sha.941e5fa3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v7.1.0-dev.20260326.sha.5d414cc9

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v7.1.0-dev.20260324.sha.4c894082

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v7.1.0-dev.20260323.sha.f7ea4219

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v7.1.0-dev.20260321.sha.7be12ee8

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v7.1.0-dev.20260320.sha.778a2a14

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v7.1.0-dev.20260319.sha.0634c9b6

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v7.1.0-dev.20260317.sha.ac98f4a9

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v7.1.0-dev.20260314.sha.275afa5f

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v7.1.0-dev.20260311.sha.aa8b39cd

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v7.1.0-dev.20260310.sha.87a34653

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v7.1.0-dev.20260307.sha.a1c04e2b

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v7.1.0-dev.20260303.sha.4d6e2a2e

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v7.1.0-dev.20260228.sha.4dbcb887

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v7.1.0-dev.20260226.sha.22c6031a

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v7.1.0-dev.20260213.sha.e5a85d07

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v7.1.0-dev.20260211.sha.e465058c

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.