← Home

rolldown-plugin-dts

npm Repository Homepage

A Rolldown plugin to generate and bundle dts files.

11
Versions
MIT
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

sxzz

Keywords

rolldownplugindtstypescriptvuejsdoc

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
dependencies unvetted-peer-dep:@ts-macro/tsc AI (dependencies): Optional peer dependency; consumer controls integration. ai
publish-pattern dormant-publish AI (publish-pattern): SLSA provenance attestation confirms CI/CD publish; dormancy is not indicative of takeover for this package. ai
dependencies unvetted-dep:obug AI (dependencies): obug is authored by sxzz (same maintainer); stable dependency for this package. ai
provenance publisher-changed AI (provenance): Transition from personal npm account to GitHub Actions CI/CD publishing; SLSA provenance confirms legitimate automation. ai
dependencies unvetted-dep:get-tsconfig AI (dependencies): get-tsconfig is a well-known TypeScript tooling utility; its presence as a dependency of a TypeScript DTS plugin is expected and benign. ai
provenance slsa-provenance AI (provenance): Package consistently publishes with SLSA provenance via CI/CD; this is a stable positive signal for this package. ai

Versions (showing 11 of 111)

Version Deps Published
0.9.7 8 / 19
0.9.6 8 / 19
0.9.5 8 / 19
0.9.4 8 / 19
0.9.3 8 / 19
0.9.2 8 / 19
0.9.1 8 / 19
0.9.0 8 / 19
0.8.6 6 / 17
0.8.5 6 / 17
0.8.4 6 / 17

v0.9.7

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.6

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.8.6

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.8.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.8.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.