compressible

Compressible Content-Type / mime checking

Supply chain provenance

Status for the latest visible version.

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

Keywords

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
provenance	missing-githead	AI (provenance): 2014-era publish; gitHead tracking was inconsistent in older npm versions. Not a concern for this well-established package.	ai	2026/04/24
provenance	publisher-changed	AI (provenance): fishrock123 is a listed contributor and known Node.js core contributor in the jshttp org; legitimate maintainer.	ai	2026/04/24
provenance	no-provenance	AI (provenance): Published in 2014, before Sigstore provenance existed. Stable for this package's older versions.	ai	2026/04/24

Version	Deps	Published
2.0.18	1 / 9	2020-01-06
2.0.17	1 / 9	2019-04-24
2.0.16	1 / 9	2019-02-18
2.0.15	1 / 9	2018-09-17
2.0.14	1 / 9	2018-06-05
2.0.13	1 / 9	2018-02-18
2.0.12	1 / 9	2017-10-20
2.0.11	1 / 9	2017-07-28
2.0.10	1 / 7	2017-03-24
2.0.9	1 / 6	2016-10-31
2.0.8	1 / 6	2016-05-12
2.0.7	1 / 2	2016-01-19
2.0.6	1 / 2	2015-09-30
2.0.5	1 / 2	2015-07-31
2.0.4	1 / 2	2015-07-02
2.0.3	1 / 2	2015-06-08
2.0.2	1 / 2	2015-02-01
2.0.1	1 / 2	2014-10-04
2.0.0	1 / 2	2014-09-02
1.1.1	0 / 1	2014-08-06
1.1.0	0 / 1	2014-06-04
1.0.1	0 / 4	2014-03-21
1.0.0	0 / 4	2014-01-01
0.2.0	0 / 1	2013-12-23
0.1.1	0 / 1	2013-12-19
0.1.0	0 / 1	2013-12-19