@tanstack/react-start-server
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:tiny-warning | AI (phantom-deps): tiny-warning is a standard utility dependency for this package. | ai | |
| phantom-deps | phantom-dep:h3 | AI (phantom-deps): h3 is a legitimate server framework dependency for this routing package. | ai | |
| phantom-deps | phantom-dep:jsesc | AI (phantom-deps): jsesc is a legitimate utility dependency referenced in config. | ai | |
| phantom-deps | phantom-dep:unctx | AI (phantom-deps): unctx is a legitimate async context utility for this package. | ai | |
| provenance | publisher-changed | AI (provenance): TanStack migrated to GitHub Actions CI/CD publishing with SLSA provenance attestation. This is a legitimate and security-improving transition, not a compromise. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): lachlancollins is a known TanStack contributor; maintainer additions in an active OSS org are routine and not a compromise signal. | ai | |
| phantom-deps | phantom-dep:@tanstack/history | AI (phantom-deps): Same-org sibling package from TanStack monorepo; phantom dep pattern is expected in monorepo package structures. | ai | |
| phantom-deps | phantom-dep:@tanstack/start-client-core | AI (phantom-deps): Same-org sibling package from TanStack monorepo; phantom dep pattern is expected in monorepo package structures. | ai |
Versions (showing 100 of 427)
v1.139.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.136.14
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.136.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.133.19
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.133.9
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.132.47
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.132.31
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.132.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.