projectz

Stop wasting time syncing and updating your project's README and Package Files!

Supply chain provenance

Status for the latest visible version.

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

Keywords

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
maintainer-change	maintainer-removed	AI (maintainer-change): Bevry org (bevryme) is the long-standing publisher; balupton remains active. Removed maintainers are historical contributors, consistent with routine cleanup rather than takeover.	ai	2026/04/24
publish-pattern	new-deps-added	AI (publish-pattern): New deps are @bevry/* first-party packages from the same author, replacing @bevry/file in a routine refactor. No supply-chain risk.	ai	2026/04/24
provenance	no-provenance	AI (provenance): Established package from trusted publisher; absence of Sigstore provenance is a best-practice gap, not a security defect.	ai	2026/04/24
dependencies	unvetted-dep:spdx-expression-parse	AI (dependencies): spdx-expression-parse is a well-known SPDX license parser from the Linux Foundation ecosystem; its use in a license-metadata tool like projectz is expected and legitimate.	ai	2026/04/23

Version	Deps	Published
0.3.1	11 / 2	2013-12-16
0.3.0	11 / 2	2013-12-12
0.2.10	11 / 2	2013-12-12
0.2.9	12 / 1	2013-12-12
0.2.8	12 / 1	2013-12-12
0.2.7	12 / 1	2013-11-25
0.2.6	12 / 1	2013-11-06
0.2.5	12 / 1	2013-10-31
0.2.4	12 / 1	2013-10-31
0.2.3	11 / 1	2013-10-23
0.2.2	11 / 1	2013-10-23
0.2.1	11 / 1	2013-10-16
0.2.0	11 / 1	2013-10-16
0.1.0	12 / 1	2013-10-15
0.0.1	1 / 1	2013-09-18