lit-element
A simple base class for creating fast, lightweight web components
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| maintainer-change | maintainer-added | AI (maintainer-change): Lit project team rotation; publisher lit-robot has clean track record and SLSA provenance confirms CI/CD build. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Same team rotation context; no evidence of hostile takeover. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Major version bump (v3→v4) explains gap; SLSA provenance confirms legitimate CI publish. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): @lit-labs/ssr-dom-shim is a first-party Lit Labs package; expected SSR support addition. | ai | |
| phantom-deps | phantom-dep:@lit-labs/ssr-dom-shim | AI (phantom-deps): Referenced in config/build files for SSR shim; stable false positive for this package. | ai |
Versions (showing 13 of 13)
| Version | Deps | Published |
|---|---|---|
| 4.2.2 | 3 / 6 | |
| 4.2.1 | 3 / 6 | |
| 4.2.0 | 3 / 6 | |
| 4.1.1 | 3 / 6 | |
| 4.1.0 | 3 / 6 | |
| 4.0.6 | 3 / 6 | |
| 4.0.5 | 3 / 6 | |
| 4.0.4 | 3 / 6 | |
| 4.0.3 | 3 / 6 | |
| 4.0.2 | 3 / 6 | |
| 4.0.1 | 3 / 6 | |
| 4.0.0 | 3 / 6 | |
| 3.2.2 | 2 / 5 |
v4.0.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.