@changesets/get-version-range-type
Common get-version-range-type shared between changeset packages
9
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
andaristemmatownnovinychangesets-release-bot
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| npm-metadata | suspicious-initial-version | AI (npm-metadata): The @changesets monorepo intentionally uses 0.0.0 for internal utility packages. This is a stable pattern for this publisher and package, not a malware indicator. | ai | |
| provenance | publisher-changed | AI (provenance): Transition from noviny to changesets-release-bot is the documented official maintainer handoff for the changesets project; stable for this package. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): changesets-release-bot and mitchellhamilton are the official maintainers of the changesets project; this is a legitimate transition. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Small utility package in a monorepo; short README, no keywords, and no runtime deps are expected and benign for this type of focused utility module. | ai |