@rpcbase/client
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): CI/CD publisher for monorepo package, consistent with wireit release pipeline. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): Well-known libs (pouchdb, sonner) added for legitimate feature growth across many skipped versions. | ai |
Versions (showing 45 of 145)
| Version | Deps | Published |
|---|---|---|
| 0.315.0 | 0 / 2 | |
| 0.314.0 | 0 / 2 | |
| 0.313.0 | 0 / 2 | |
| 0.312.0 | 0 / 2 | |
| 0.311.0 | 0 / 2 | |
| 0.310.0 | 0 / 2 | |
| 0.309.0 | 0 / 2 | |
| 0.308.0 | 0 / 2 | |
| 0.307.0 | 0 / 2 | |
| 0.306.0 | 0 / 2 | |
| 0.305.0 | 0 / 2 | |
| 0.304.0 | 0 / 2 | |
| 0.303.0 | 0 / 2 | |
| 0.302.0 | 0 / 2 | |
| 0.301.0 | 0 / 2 | |
| 0.300.0 | 0 / 2 | |
| 0.299.0 | 0 / 2 | |
| 0.298.0 | 0 / 2 | |
| 0.297.0 | 0 / 2 | |
| 0.296.0 | 0 / 2 | |
| 0.295.0 | 0 / 2 | |
| 0.294.0 | 0 / 2 | |
| 0.293.0 | 0 / 2 | |
| 0.292.0 | 0 / 2 | |
| 0.291.0 | 0 / 2 | |
| 0.290.0 | 0 / 2 | |
| 0.289.0 | 0 / 2 | |
| 0.288.0 | 0 / 2 | |
| 0.287.0 | 0 / 2 | |
| 0.286.0 | 4 / 0 | |
| 0.285.0 | 4 / 0 | |
| 0.284.0 | 4 / 0 | |
| 0.283.0 | 4 / 0 | |
| 0.282.0 | 4 / 0 | |
| 0.281.0 | 4 / 0 | |
| 0.280.0 | 4 / 0 | |
| 0.279.0 | 4 / 0 | |
| 0.278.0 | 4 / 0 | |
| 0.277.0 | 4 / 0 | |
| 0.242.0 | 3 / 0 | |
| 0.235.0 | 1 / 0 | |
| 0.234.0 | 1 / 0 | |
| 0.233.0 | 1 / 0 | |
| 0.232.0 | 1 / 0 | |
| 0.231.0 | 1 / 0 |
v0.242.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.235.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.234.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.233.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.232.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.231.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.