← Home

@valkey/valkey-glide

npm Repository Homepage
18
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

mat-szvalkey-glidereconditerose

Keywords

valkeyredisclientdriverdatabasenapitypescriptrustcross-platformclusterstandalonehigh-availabilityperformanceopen-sourcefault-tolerantdistributedscalableresilientvalkey-glide

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance publisher-changed AI (provenance): Package is published via GitHub Actions CI/CD with SLSA attestation; publisher=GitHub Actions is the expected pattern for this org. ai
semgrep semgrep:child-process-import AI (semgrep): Used only for musl detection via 'which ldd'; stable platform-detection pattern for this NAPI package. ai
semgrep semgrep:child-process-execsync AI (semgrep): execSync('which ldd') is a fixed, safe platform-detection call; no user-controlled input involved. ai

Versions (showing 18 of 18)

Version Deps Published
2.5.0 2 / 20
2.4.2 2 / 19
2.4.1 2 / 19
2.4.0 2 / 19
2.3.1 2 / 19
2.3.0 2 / 19
2.2.10 2 / 19
2.2.9 2 / 19
2.2.7 2 / 19
2.2.6 2 / 19
2.2.5 2 / 19
2.2.1 2 / 18
2.2.0 2 / 18
2.1.2 2 / 18
2.1.1 2 / 18
2.1.0 2 / 18
2.0.1 2 / 18
2.0.0 2 / 18

v2.5.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.