← Home

@quilted/preact-router

npm Repository

A universal router for React with first-class support for the [WHATWG `URL`](https://developer.mozilla.org/en-US/docs/Web/API/URL) and preloading.

8
Versions
MIT
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

lemonmade

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
bogus-package bogus-package AI (bogus-package): Sparse README typical of monorepo sub-packages, not spam. ai
dependencies unvetted-dep:@quilted/async AI (dependencies): Same-org sibling package in monorepo, not third-party. ai
dependencies unvetted-dep:@quilted/routing AI (dependencies): Same-org sibling package in monorepo, not third-party. ai
dependencies unvetted-dep:@quilted/preact-async AI (dependencies): Same-org sibling package in monorepo, not third-party. ai
dependencies unvetted-dep:@quilted/preact-performance AI (dependencies): Same-org sibling package in monorepo, not third-party. ai
publish-pattern rapid-publish AI (publish-pattern): Monorepo lockstep release pattern, no material diff vs prior version. ai
provenance publisher-changed AI (provenance): Transition from lemonmade to GitHub Actions CI/CD publishing is backed by SLSA provenance attestation from the official repo. ai
typosquat typosquat.levenshtein:react-router AI (typosquat): Legitimate @quilted monorepo package for Preact routing; not a typosquat of react-router. ai
phantom-deps phantom-dep:@quilted/http AI (phantom-deps): First-party sibling dep; phantom-dep heuristic unreliable for same-org monorepo packages. ai
phantom-deps phantom-dep:@quilted/preact-async AI (phantom-deps): First-party sibling dep; same-org monorepo false positive. ai
phantom-deps phantom-dep:@quilted/preact-browser AI (phantom-deps): First-party sibling dep; same-org monorepo false positive. ai
phantom-deps phantom-dep:@quilted/preact-performance AI (phantom-deps): First-party sibling dep; same-org monorepo false positive. ai

Versions (showing 8 of 8)

Version Deps Published
0.6.0 8 / 3
0.5.1 8 / 3
0.4.1 8 / 3
0.3.0 8 / 3
0.2.17 8 / 2
0.2.13 8 / 2
0.2.2 8 / 2
0.2.1 8 / 2

v0.6.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.2.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.2.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.