netlify
Netlify command line tool
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): yauzl is a well-established zip library; swap from extract-zip is a routine refactor for this package. | ai | |
| dependencies | unvetted-dep:express-logging | AI (dependencies): Express middleware for logging; benign dependency for local dev server. | ai | |
| dependencies | unvetted-dep:http-proxy | AI (dependencies): Well-known, widely-used proxy library; stable dependency for this CLI. | ai | |
| dependencies | unvetted-dep:ascii-table | AI (dependencies): Small utility library; no security concern for this CLI. | ai | |
| dependencies | unvetted-dep:gh-release-fetch | AI (dependencies): Used for fetching GitHub releases; expected in a CLI tool. | ai | |
| dependencies | unvetted-dep:@netlify/build-info | AI (dependencies): First-party @netlify scoped package; trusted for this CLI. | ai | |
| dependencies | unvetted-dep:@netlify/local-functions-proxy | AI (dependencies): First-party @netlify scoped package; trusted for this CLI. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Active Netlify CLI with 280 versions; dormancy reflects publisher account history, not package inactivity. | ai | |
| phantom-deps | phantom-dep:@opentelemetry/api | AI (phantom-deps): Declared dep used via config/indirect reference; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@netlify/edge-functions | AI (phantom-deps): Framework-scoped package loaded by convention; stable false positive for this CLI. | ai | |
| phantom-deps | phantom-dep:write-file-atomic | AI (phantom-deps): Declared dep used via config/indirect reference; stable false positive for this package. | ai | |
| install-scripts | install-script:postinstall | AI (install-scripts): Official Netlify CLI; postinstall runs a local JS script, consistent with CLI setup across all versions. | ai |
Versions (showing 24 of 24)
| Version | Deps | Published |
|---|---|---|
| 26.1.0 | 97 / 64 | |
| 26.0.2 | 98 / 63 | |
| 26.0.1 | 98 / 63 | |
| 26.0.0 | 98 / 63 | |
| 25.6.2 | 98 / 63 | |
| 25.6.1 | 98 / 63 | |
| 25.6.0 | 98 / 63 | |
| 25.5.0 | 98 / 62 | |
| 25.2.0 | 98 / 62 | |
| 25.1.1 | 98 / 62 | |
| 25.1.0 | 98 / 62 | |
| 25.0.1 | 98 / 62 | |
| 25.0.0 | 98 / 62 | |
| 24.11.3 | 97 / 0 | |
| 24.11.2 | 97 / 0 | |
| 24.10.0 | 97 / 0 | |
| 24.9.0 | 97 / 0 | |
| 24.8.2 | 97 / 0 | |
| 24.4.1 | 97 / 0 | |
| 24.2.0 | 97 / 0 | |
| 23.13.1 | 95 / 0 | |
| 23.13.0 | 95 / 0 | |
| 23.11.1 | 95 / 0 | |
| 23.10.0 | 96 / 0 |
v26.1.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v26.0.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v26.0.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v25.6.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v25.6.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v25.5.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v25.2.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v25.1.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v25.1.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v25.0.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v25.0.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v24.11.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v24.11.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v24.10.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v24.9.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v24.8.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v24.4.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v24.2.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v23.13.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v23.13.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v23.11.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v23.10.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.