@gjsify/canvas2d
Canvas 2D rendering context for GJS, backed by Cairo
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Transition from manual publish (jumplink) to GitHub Actions CI/CD is a provenance improvement, not a compromise signal. | ai | |
| phantom-deps | phantom-dep:@girs/gjs | AI (phantom-deps): GJS runtime type dep referenced in config; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@gjsify/event-bridge | AI (phantom-deps): Same-org dep; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@gjsify/dom-events | AI (phantom-deps): Same-org dep used as type/config reference; stable false positive for this package. | ai | |
| dependencies | unvetted-dep:@girs/gtk-4.0 | AI (dependencies): GTK4 type bindings; expected for this GJS canvas package. | ai | |
| dependencies | unvetted-dep:@girs/gjs | AI (dependencies): GJS type bindings; expected dependency for a GJS-targeting canvas library. | ai | |
| dependencies | unvetted-dep:@girs/gdk-4.0 | AI (dependencies): GTK4 GDK type bindings; expected for this GJS canvas package. | ai | |
| dependencies | unvetted-dep:@girs/glib-2.0 | AI (dependencies): GLib type bindings; expected for this GJS canvas package. | ai | |
| dependencies | unvetted-dep:@girs/pango-1.0 | AI (dependencies): Pango type bindings; expected for text rendering in a canvas library. | ai | |
| dependencies | unvetted-dep:@girs/gobject-2.0 | AI (dependencies): GObject type bindings; expected for this GJS canvas package. | ai | |
| dependencies | unvetted-dep:@girs/gdkpixbuf-2.0 | AI (dependencies): GdkPixbuf type bindings; expected for image handling in a canvas library. | ai | |
| dependencies | unvetted-dep:@girs/pangocairo-1.0 | AI (dependencies): PangoCairo type bindings; expected for Cairo-backed text rendering. | ai | |
| phantom-deps | phantom-dep:@girs/gdkpixbuf-2.0 | AI (phantom-deps): GJS type-binding dep referenced in config; not a direct import by design. | ai | |
| phantom-deps | phantom-dep:@girs/pangocairo-1.0 | AI (phantom-deps): GJS type-binding dep referenced in config; not a direct import by design. | ai | |
| phantom-deps | phantom-dep:@girs/glib-2.0 | AI (phantom-deps): GJS type-binding dep referenced in config; not a direct import by design. | ai | |
| phantom-deps | phantom-dep:@gjsify/utils | AI (phantom-deps): Same-org utility dep; phantom detection is a false positive for this package. | ai | |
| phantom-deps | phantom-dep:@girs/gdk-4.0 | AI (phantom-deps): GJS type-binding dep referenced in config; not a direct import by design. | ai | |
| phantom-deps | phantom-dep:@girs/gtk-4.0 | AI (phantom-deps): GJS type-binding dep referenced in config; not a direct import by design. | ai | |
| phantom-deps | phantom-dep:@girs/gobject-2.0 | AI (phantom-deps): GJS type-binding dep referenced in config; not a direct import by design. | ai |
Versions (showing 4 of 4)
| Version | Deps | Published |
|---|---|---|
| 0.13.2 | 13 / 4 | |
| 0.4.21 | 13 / 4 | |
| 0.3.21 | 12 / 4 | |
| 0.3.20 | 12 / 4 |
v0.13.2
2 findingsThis version was published by a different npm account than previous versions on 2026-06-29. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.4.21
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2026-05-22. This could indicate a legitimate maintainer transition or an account compromise.