Skip to content

Release 1.18.0: npm trusted publishing with OIDC

Choose a tag to compare

View all tags
@mobilemind mobilemind released this 09 Dec 03:08
· 54 commits to main since this release
1.18.0
This tag was signed with the committer’s verified signature.
mobilemind Tom King
SSH Key Fingerprint: kt6HafYP88KVWFo1CugQtNPrJiw5eM0OqwZysgmaS5Y
Verified
Learn about vigilant mode.
2bdc1e1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

  • Merge pull request #242 from mobilemind/chore/npm-publishing-update (2bdc1e1)
  • chore(publishing): bump npm requirement & package version, update docs; republish (3c8e153)
  • Merge pull request #241 from mobilemind/chore/npm-publishing (3d2433d)
  • chore(publishing): switch to OIDC authentication (3f2c408)
  • chore(actions): more resilient, off-peak Dependabot config (ee03fae)
  • Merge pull request #240 from mobilemind/dependabot/github_actions/actions/checkout-6 (5576514)
  • build(deps): bump actions/checkout from 5 to 6 (cbbe1ff)
  • chore: more cautious ignores (3cb7111)

Verification

This release includes:

  • ✅ ZERO production dependencies (no supply chain to audit)
  • Signed commits and tags
  • npm provenance attestation for build transparency
  • Security audit results from CI pipeline

Verify Package Integrity

# View provenance attestation
npm view js2uri@1.18.0 --json

# Verify zero dependencies
npm view js2uri@1.18.0 dependencies
Assets 2
Loading