@tldraw/sync
tldraw infinite canvas SDK (multiplayer sync react bindings).
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): tldraw migrated to GitHub Actions CI publishing with SLSA attestation; stable pattern for this package going forward. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): New maintainers follow tldraw org naming convention; consistent with org-level CI publishing transition. | ai | |
| typosquat | typosquat.levenshtein:async | AI (typosquat): Scoped package @tldraw/sync is not a typosquat of unscoped 'async'; completely different namespace and purpose. | ai | |
| semgrep | semgrep:shady-links-tlds | AI (semgrep): tldraw.xyz is the official tldraw demo/image worker domain, not a C2 endpoint. | ai | |
| phantom-deps | phantom-dep:ws | AI (phantom-deps): ws is a declared runtime dependency used by sync-core internals; phantom-dep heuristic misfires on transitive usage patterns. | ai | |
| phantom-deps | phantom-dep:nanoevents | AI (phantom-deps): nanoevents is a declared runtime dependency; phantom-dep heuristic misfires on this package's bundled output. | ai |
Versions (showing 44 of 44)
| Version | Deps | Published |
|---|---|---|
| 5.2.5 | 7 / 8 | |
| 5.2.4 | 7 / 8 | |
| 5.2.3 | 7 / 8 | |
| 5.2.2 | 7 / 8 | |
| 5.2.1 | 7 / 8 | |
| 5.2.0 | 7 / 8 | |
| 5.1.1 | 7 / 8 | |
| 5.1.0 | 7 / 8 | |
| 5.0.1 | 7 / 8 | |
| 5.0.0 | 7 / 8 | |
| 4.5.12 | 7 / 8 | |
| 4.5.10 | 7 / 8 | |
| 4.5.9 | 7 / 8 | |
| 4.5.8 | 7 / 8 | |
| 4.5.7 | 7 / 8 | |
| 4.5.6 | 7 / 8 | |
| 4.5.5 | 7 / 8 | |
| 4.5.4 | 7 / 8 | |
| 4.5.3 | 7 / 8 | |
| 4.5.2 | 7 / 8 | |
| 4.5.1 | 7 / 8 | |
| 4.5.0 | 7 / 8 | |
| 4.4.2 | 7 / 8 | |
| 4.4.1 | 7 / 8 | |
| 4.4.0 | 7 / 8 | |
| 4.3.3 | 7 / 8 | |
| 4.3.2 | 7 / 8 | |
| 4.3.1 | 7 / 8 | |
| 4.3.0 | 7 / 8 | |
| 4.2.4 | 7 / 7 | |
| 4.2.3 | 7 / 7 | |
| 4.2.2 | 7 / 8 | |
| 4.2.1 | 7 / 7 | |
| 4.2.0 | 7 / 7 | |
| 4.1.3 | 7 / 7 | |
| 4.1.2 | 7 / 7 | |
| 4.1.1 | 7 / 7 | |
| 4.1.0 | 7 / 7 | |
| 4.0.5 | 7 / 6 | |
| 4.0.3 | 7 / 6 | |
| 4.0.2 | 7 / 6 | |
| 4.0.1 | 7 / 6 | |
| 4.0.0 | 7 / 6 | |
| 3.15.6 | 7 / 6 |
v5.2.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.2.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.2.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.2.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.2.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.2.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.