← Home

bare-fetch

npm Repository Homepage

WHATWG Fetch implementation for Bare

14
Versions
Apache-2.0
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

mafintosh

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
publish-pattern dormant-publish AI (publish-pattern): SLSA provenance attestation confirms CI/CD publish; Holepunch org package with consistent repo URL. ai
dependencies unvetted-dep:bare-http1 AI (dependencies): Holepunch bare-* ecosystem dep; consistent with package's purpose. ai
dependencies unvetted-dep:bare-https AI (dependencies): Holepunch bare-* ecosystem dep; consistent with package's purpose. ai
dependencies unvetted-dep:bare-zlib AI (dependencies): Holepunch bare-* ecosystem dep; consistent with package's purpose. ai
dependencies unvetted-peer-dep:bare-buffer AI (dependencies): Optional peer dep from same Holepunch ecosystem; stable false positive. ai
dependencies unvetted-peer-dep:bare-abort-controller AI (dependencies): Optional peer dep from same Holepunch ecosystem; stable false positive. ai
dependencies unvetted-dep:bare-form-data AI (dependencies): Holepunch bare-* ecosystem dep; consistent with package's purpose. ai

Versions (showing 14 of 14)

Version Deps Published
3.2.0 8 / 7
3.1.0 8 / 7
3.0.2 8 / 7
3.0.1 7 / 7
3.0.0 7 / 7
2.9.0 7 / 7
2.8.2 6 / 7
2.8.1 6 / 7
2.8.0 6 / 6
2.7.3 5 / 6
2.7.2 5 / 6
2.7.1 5 / 6
2.7.0 5 / 6
2.5.1 5 / 5

v3.2.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.1.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.0.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.