stylus
Robust, expressive, and feature-rich CSS superset
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Publisher change from tjholowaychuk to kizu occurred in 2013 — a historical, legitimate maintainer transition. kizu has 111 approved packages and 4679 days of ecosystem history. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): kizu was added as maintainer in 2013 as part of a legitimate transition; long-standing trusted contributor with strong track record. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require in lib/functions/use.js is the documented Stylus @use plugin-loading mechanism — intentional and expected for this CSS preprocessor. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): new Function() in lib/nodes/function.js is used for AST function node cloning in the Stylus language runtime — standard pattern for parsers/template engines. | ai | |
| provenance | no-provenance | AI (provenance): Stylus is an established open-source project; lack of Sigstore provenance is common and not a disqualifier here. | ai |
Versions (showing 100 of 168)
| Version | Deps | Published |
|---|---|---|
| 0.64.0 | 5 / 2 | |
| 0.63.0 | 5 / 2 | |
| 0.62.0 | 5 / 2 | |
| 0.61.0 | 5 / 2 | |
| 0.60.0 | 5 / 2 | |
| 0.59.0 | 5 / 2 | |
| 0.58.1 | 5 / 2 | |
| 0.58.0 | 5 / 2 | |
| 0.57.0 | 6 / 2 | |
| 0.56.0 | 6 / 3 | |
| 0.55.0 | 8 / 3 | |
| 0.54.8 | 8 / 3 | |
| 0.54.7 | 8 / 3 | |
| 0.54.6 | 8 / 3 | |
| 0.54.5 | 6 / 3 | |
| 0.54.4 | 6 / 3 | |
| 0.54.3 | 6 / 3 | |
| 0.54.2 | 6 / 3 | |
| 0.54.0 | 6 / 3 | |
| 0.53.0 | 6 / 3 | |
| 0.52.4 | 6 / 3 | |
| 0.52.3 | 6 / 3 | |
| 0.52.2 | 6 / 3 | |
| 0.52.1 | 6 / 3 | |
| 0.52.0 | 6 / 3 | |
| 0.51.1 | 6 / 3 | |
| 0.51.0 | 6 / 3 | |
| 0.50.0 | 6 / 3 | |
| 0.49.3 | 6 / 3 | |
| 0.49.2 | 6 / 3 | |
| 0.49.1 | 6 / 3 | |
| 0.49.0 | 6 / 3 | |
| 0.48.1 | 6 / 3 | |
| 0.48.0 | 6 / 3 | |
| 0.47.3 | 5 / 3 | |
| 0.47.2 | 5 / 3 | |
| 0.47.1 | 5 / 3 | |
| 0.47.0 | 5 / 3 | |
| 0.46.3 | 5 / 3 | |
| 0.46.2 | 5 / 3 | |
| 0.46.1 | 5 / 3 | |
| 0.46.0 | 5 / 3 | |
| 0.45.1 | 5 / 3 | |
| 0.45.0 | 5 / 3 | |
| 0.44.0 | 5 / 2 | |
| 0.43.1 | 5 / 2 | |
| 0.43.0 | 5 / 2 | |
| 0.42.3 | 5 / 2 | |
| 0.42.2 | 5 / 2 | |
| 0.42.1 | 5 / 2 | |
| 0.42.0 | 5 / 2 | |
| 0.41.3 | 4 / 2 | |
| 0.41.2 | 4 / 2 | |
| 0.41.1 | 4 / 2 | |
| 0.41.0 | 4 / 2 | |
| 0.40.3 | 4 / 2 | |
| 0.40.2 | 4 / 2 | |
| 0.40.1 | 4 / 2 | |
| 0.40.0 | 4 / 2 | |
| 0.39.4 | 4 / 2 | |
| 0.39.3 | 4 / 2 | |
| 0.39.2 | 4 / 2 | |
| 0.39.1 | 4 / 2 | |
| 0.39.0 | 4 / 2 | |
| 0.38.0 | 4 / 2 | |
| 0.37.0 | 4 / 2 | |
| 0.36.1 | 4 / 2 | |
| 0.36.0 | 4 / 2 | |
| 0.35.1 | 4 / 2 | |
| 0.35.0 | 4 / 2 | |
| 0.34.1 | 3 / 2 | |
| 0.34.0 | 3 / 2 | |
| 0.33.1 | 3 / 2 | |
| 0.33.0 | 3 / 2 | |
| 0.32.1 | 3 / 2 | |
| 0.32.0 | 3 / 2 | |
| 0.31.0 | 3 / 2 | |
| 0.30.1 | 3 / 2 | |
| 0.30.0 | 3 / 2 | |
| 0.29.0 | 3 / 2 | |
| 0.28.2 | 3 / 2 | |
| 0.28.1 | 3 / 2 | |
| 0.28.0 | 3 / 2 | |
| 0.27.2 | 3 / 2 | |
| 0.27.1 | 3 / 2 | |
| 0.27.0 | 3 / 2 | |
| 0.26.1 | 3 / 2 | |
| 0.26.0 | 3 / 2 | |
| 0.25.0 | 3 / 2 | |
| 0.24.0 | 4 / 0 | |
| 0.23.0 | 3 / 0 | |
| 0.22.6 | 3 / 0 | |
| 0.22.5 | 3 / 0 | |
| 0.22.4 | 3 / 0 | |
| 0.22.3 | 3 / 0 | |
| 0.22.2 | 3 / 0 | |
| 0.22.1 | 3 / 0 | |
| 0.22.0 | 3 / 0 | |
| 0.21.2 | 3 / 0 | |
| 0.21.1 | 3 / 0 |
v0.63.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2024-03-05. This could indicate a legitimate maintainer transition or an account compromise.
v0.62.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2023-11-18. This could indicate a legitimate maintainer transition or an account compromise.
v0.61.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2023-11-04. This could indicate a legitimate maintainer transition or an account compromise.
v0.60.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2023-08-30. This could indicate a legitimate maintainer transition or an account compromise.
v0.59.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2022-08-13. This could indicate a legitimate maintainer transition or an account compromise.
v0.58.1
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2022-05-31. This could indicate a legitimate maintainer transition or an account compromise.
v0.58.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2022-05-28. This could indicate a legitimate maintainer transition or an account compromise.
v0.57.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2022-02-19. This could indicate a legitimate maintainer transition or an account compromise.
v0.56.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2021-12-18. This could indicate a legitimate maintainer transition or an account compromise.
v0.55.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2021-09-04. This could indicate a legitimate maintainer transition or an account compromise.
v0.54.8
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2020-07-16. This could indicate a legitimate maintainer transition or an account compromise.
v0.54.7
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2019-08-21. This could indicate a legitimate maintainer transition or an account compromise.
v0.54.6
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2019-08-20. This could indicate a legitimate maintainer transition or an account compromise.
v0.54.5
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2016-04-27. This could indicate a legitimate maintainer transition or an account compromise.
v0.54.4
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2016-04-27. This could indicate a legitimate maintainer transition or an account compromise.
v0.54.3
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2016-04-26. This could indicate a legitimate maintainer transition or an account compromise.
v0.54.2
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2016-03-11. This could indicate a legitimate maintainer transition or an account compromise.
v0.54.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.53.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.52.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.52.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.52.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.52.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.52.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.51.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.51.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.50.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.49.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.49.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.49.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.49.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.48.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.48.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.47.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.47.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.47.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.47.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.46.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.46.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.46.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.46.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.45.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.45.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.44.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2014-04-23. This could indicate a legitimate maintainer transition or an account compromise.
v0.43.1
2 findingsThis version was published by a different npm account than previous versions on 2014-04-07. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.43.0
2 findingsThis version was published by a different npm account than previous versions on 2014-04-05. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.42.3
2 findingsThis version was published by a different npm account than previous versions on 2014-03-03. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.42.2
2 findingsThis version was published by a different npm account than previous versions on 2014-01-30. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.42.1
2 findingsThis version was published by a different npm account than previous versions on 2014-01-18. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.42.0
2 findingsThis version was published by a different npm account than previous versions on 2014-01-06. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.41.3
2 findingsThis version was published by a different npm account than previous versions on 2013-12-12. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.41.2
2 findingsThis version was published by a different npm account than previous versions on 2013-12-10. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.41.1
2 findingsThis version was published by a different npm account than previous versions on 2013-12-08. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.41.0
2 findingsThis version was published by a different npm account than previous versions on 2013-11-30. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.40.3
2 findingsThis version was published by a different npm account than previous versions on 2013-11-16. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.40.2
2 findingsThis version was published by a different npm account than previous versions on 2013-11-12. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.40.1
2 findingsThis version was published by a different npm account than previous versions on 2013-11-12. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.40.0
2 findingsThis version was published by a different npm account than previous versions on 2013-11-05. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.39.4
2 findingsThis version was published by a different npm account than previous versions on 2013-11-03. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.39.3
2 findingsThis version was published by a different npm account than previous versions on 2013-11-01. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.39.2
2 findingsThis version was published by a different npm account than previous versions on 2013-10-31. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.39.1
2 findingsThis version was published by a different npm account than previous versions on 2013-10-30. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.39.0
2 findingsThis version was published by a different npm account than previous versions on 2013-10-30. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.38.0
2 findingsThis version was published by a different npm account than previous versions on 2013-09-24. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.37.0
2 findingsThis version was published by a different npm account than previous versions on 2013-08-18. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.36.1
2 findingsThis version was published by a different npm account than previous versions on 2013-08-06. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.36.0
2 findingsThis version was published by a different npm account than previous versions on 2013-08-01. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.35.1
2 findingsThis version was published by a different npm account than previous versions on 2013-07-29. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.35.0
2 findingsThis version was published by a different npm account than previous versions on 2013-07-28. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.34.1
2 findingsThis version was published by a different npm account than previous versions on 2013-07-12. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.34.0
2 findingsThis version was published by a different npm account than previous versions on 2013-07-12. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.33.1
2 findingsThis version was published by a different npm account than previous versions on 2013-06-30. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.33.0
2 findingsThis version was published by a different npm account than previous versions on 2013-06-30. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.32.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.32.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.31.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.30.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.30.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.29.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.28.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.28.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.28.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.27.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.27.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.27.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.26.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.26.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.25.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.24.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.23.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.22.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.22.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.22.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.22.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.22.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.22.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.22.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.21.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.21.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.