@dxos/lock-file MIT 32 versions

@dxos/lock-file

npm Repository Homepage

Lock file .

32

Versions

MIT

License

No

Install Scripts

Verified

Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

richburdonmarik_dwittjosiahdxos-botmykola-vrmchk

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
provenance	publisher-changed	AI (provenance): SLSA attestation confirms CI/CD publish; GitHub Actions publisher is expected for this org's pipeline going forward.	ai	2026/06/16
publish-pattern	new-deps-added	AI (publish-pattern): koffi is a well-known FFI library; swap from fs-ext is a legitimate native binding replacement for lock-file ops.	ai	2026/06/16
phantom-deps	phantom-dep:@dxos/async	AI (phantom-deps): Same-org monorepo dep; phantom-dep heuristic is a stable false positive for @dxos/* packages.	ai	2026/05/27
phantom-deps	phantom-dep:@dxos/node-std	AI (phantom-deps): Same-org monorepo dep; phantom-dep heuristic is a stable false positive for @dxos/* packages.	ai	2026/05/27

Versions (showing 32 of 32)

Version	Deps	Published
0.10.0	3 / 0	2026-07-02
0.9.0	3 / 0	2026-06-15
0.8.3	3 / 1	2025-07-03
0.8.2	3 / 1	2025-06-17
0.8.1	3 / 1	2025-04-30
0.8.0	3 / 1	2025-03-15
0.7.4	3 / 1	2024-12-19
0.7.3	3 / 1	2024-12-16
0.7.2	3 / 1	2024-12-05
0.7.1	3 / 1	2024-11-26
0.7.0	3 / 1	2024-11-21
0.6.13	4 / 4	2024-10-22
0.6.12	4 / 4	2024-10-16
0.6.11	4 / 4	2024-09-23
0.6.10	4 / 4	2024-09-18
0.6.9	4 / 4	2024-09-06
0.6.8	4 / 4	2024-09-05
0.6.7	4 / 4	2024-08-26
0.6.6	4 / 4	2024-08-22
0.6.5	4 / 4	2024-08-12
0.6.4	4 / 4	2024-08-02
0.6.3	4 / 4	2024-07-26
0.6.2	4 / 4	2024-07-16
0.6.1	4 / 4	2024-07-11
0.6.0	4 / 4	2024-07-04
0.5.8	4 / 4	2024-06-14
0.5.7	4 / 4	2024-06-12
0.5.6	4 / 4	2024-06-11
0.5.5	4 / 4	2024-05-30
0.5.4	4 / 4	2024-05-29
0.5.3	4 / 4	2024-05-28
0.5.2	4 / 4	2024-05-17

v0.10.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.8.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.8.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.13

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.12

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.11

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.10

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.5.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.