@phosphor/signaling

Supply chain provenance

Status for the latest visible version.

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
provenance	publisher-changed	AI (provenance): blink1073 (Steven Silvester) is a listed contributor in package.json and a long-standing PhosphorJS team member with excellent track record. Legitimate maintainer transition.	ai	2026/04/24
maintainer-change	maintainer-added	AI (maintainer-change): blink1073 and phosphor-user are legitimate PhosphorJS project maintainers; blink1073 is already a listed contributor in package.json.	ai	2026/04/24
maintainer-change	maintainer-removed	AI (maintainer-change): Removal of 'phosphor' account is part of the documented PhosphorJS project maintainer transition; not indicative of a takeover given the context.	ai	2026/04/24

Version	Deps	Published
1.3.1	1 / 14	2019-10-15
1.3.0	1 / 14	2019-08-05
1.2.3	1 / 14	2019-06-01
1.2.2	1 / 3	2017-06-28
1.2.1	1 / 3	2017-06-12
1.2.0	1 / 3	2017-05-15
1.1.0	1 / 2	2017-04-03
1.0.0	1 / 2	2017-03-21
0.1.2	1 / 2	2017-03-04
0.1.1	1 / 0	2017-02-21
0.1.0	1 / 0	2017-02-17