eslint-plugin-jsonc
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:jsonc-eslint-parser | AI (dependencies): jsonc-eslint-parser is the core parser dependency authored by the same maintainer (ota-meshi); it is a legitimate, purpose-built dependency for this ESLint plugin. | ai | |
| dependencies | unvetted-dep:eslint-json-compat-utils | AI (dependencies): eslint-json-compat-utils is a legitimate ESLint ecosystem utility; its use here is consistent with the plugin's documented functionality. | ai | |
| dependencies | unvetted-dep:@ota-meshi/ast-token-store | AI (dependencies): @ota-meshi/ast-token-store is authored by the same maintainer (ota-meshi) and is a legitimate AST utility dependency for this plugin. | ai |
Versions (showing 6 of 6)
| Version | Deps | Published |
|---|---|---|
| 3.1.2 | 9 / 51 | |
| 3.1.1 | 9 / 51 | |
| 3.1.0 | 9 / 51 | |
| 3.0.1 | 9 / 51 | |
| 3.0.0 | 9 / 51 | |
| 2.21.1 | 9 / 49 |
v3.1.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.1.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.1.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.0.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.0.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.21.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.