@stryke/trpc-next
A package to help in using tRPC in modern NextJs applications.
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Transition to GitHub Actions publisher is backed by SLSA provenance attestation; consistent with CI/CD automation for this org. | ai | |
| phantom-deps | phantom-dep:defu | AI (phantom-deps): Declared runtime dep; likely bundled into dist outputs, not directly imported in source. | ai | |
| phantom-deps | phantom-dep:superjson | AI (phantom-deps): Declared runtime dep; likely bundled into dist outputs, not directly imported in source. | ai | |
| phantom-deps | phantom-dep:@js-temporal/polyfill | AI (phantom-deps): Declared runtime dep; likely bundled into dist outputs, not directly imported in source. | ai | |
| dependencies | unvetted-dep:@trpc/next | AI (dependencies): Legitimate official tRPC package; stable dependency for this tRPC-Next wrapper. | ai | |
| dependencies | unvetted-dep:@trpc/tanstack-react-query | AI (dependencies): Legitimate official tRPC package; stable dependency for this tRPC-Next wrapper. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Established monorepo package with 85 versions; low-score signals (no keywords, README content) are not meaningful risk here. | ai |
Versions (showing 16 of 116)
| Version | Deps | Published |
|---|---|---|
| 0.5.8 | 13 / 3 | |
| 0.5.7 | 13 / 3 | |
| 0.5.6 | 13 / 3 | |
| 0.5.5 | 13 / 3 | |
| 0.5.4 | 13 / 3 | |
| 0.5.3 | 13 / 3 | |
| 0.5.2 | 13 / 3 | |
| 0.5.1 | 13 / 3 | |
| 0.5.0 | 13 / 3 | |
| 0.4.1 | 13 / 3 | |
| 0.4.0 | 14 / 3 | |
| 0.3.0 | 14 / 3 | |
| 0.2.1 | 14 / 3 | |
| 0.2.0 | 14 / 3 | |
| 0.1.1 | 14 / 3 | |
| 0.1.0 | 14 / 3 |
v0.5.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.5.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.5.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.5.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.5.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.5.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.4.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.4.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.3.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.2.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.2.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.