@atproto/lex-client
HTTP client for interacting with Lexicon based APIs
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Transition to GitHub Actions publishing with SLSA attestation; consistent with bluesky-social/atproto monorepo CI/CD practices. | ai | |
| npm-metadata | suspicious-initial-version | AI (npm-metadata): @atproto monorepo uses 0.0.0 as a standard workspace placeholder version across all its packages. | ai | |
| dependencies | unvetted-dep:@atproto/lex-schema | AI (dependencies): Sibling package from the same bluesky-social/atproto monorepo; unvetted status is a pipeline artifact, not a real risk. | ai |
Versions (showing 35 of 35)
| Version | Deps | Published |
|---|---|---|
| 0.3.0 | 4 / 3 | |
| 0.2.4 | 4 / 3 | |
| 0.2.3 | 4 / 3 | |
| 0.2.2 | 4 / 3 | |
| 0.2.1 | 4 / 3 | |
| 0.2.0 | 4 / 3 | |
| 0.1.5 | 4 / 3 | |
| 0.1.4 | 4 / 3 | |
| 0.1.3 | 4 / 3 | |
| 0.1.2 | 4 / 3 | |
| 0.1.1 | 4 / 3 | |
| 0.1.0 | 4 / 3 | |
| 0.0.22 | 4 / 3 | |
| 0.0.21 | 4 / 3 | |
| 0.0.20 | 4 / 3 | |
| 0.0.19 | 4 / 3 | |
| 0.0.18 | 4 / 3 | |
| 0.0.17 | 4 / 3 | |
| 0.0.16 | 4 / 3 | |
| 0.0.15 | 4 / 3 | |
| 0.0.14 | 4 / 3 | |
| 0.0.13 | 4 / 3 | |
| 0.0.12 | 4 / 3 | |
| 0.0.11 | 4 / 3 | |
| 0.0.10 | 4 / 3 | |
| 0.0.9 | 4 / 3 | |
| 0.0.8 | 4 / 3 | |
| 0.0.7 | 4 / 3 | |
| 0.0.6 | 4 / 3 | |
| 0.0.5 | 4 / 3 | |
| 0.0.4 | 4 / 3 | |
| 0.0.3 | 4 / 3 | |
| 0.0.2 | 4 / 3 | |
| 0.0.1 | 4 / 3 | |
| 0.0.0 | 4 / 3 |
v0.3.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.2.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.2.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.2.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.2.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.2.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.