Skip to content

@edgeproc/errors 0.1.1

Choose a tag to compare

@hseshadr hseshadr released this 03 Aug 19:31
· 57 commits to main since this release
97dbb3b

The code is byte-identical to 0.1.0. What changes is provenance.

0.1.0 was published by hand, so it carries no attestation — npm has no "pending publisher" state, so a package name must exist before a trusted publisher can attach, and the first publish of any name therefore cannot use OIDC. A published version is immutable, so 0.1.0 can never be fixed retroactively.

0.1.1 is the first release through the trusted-publisher rail, signed into npm's transparency log by GitHub OIDC with no credential in the repo.

Verify: npm view @edgeproc/errors@0.1.1 dist.attestations → predicateType: https://slsa.dev/provenance/v1.