Recordsnpm@sigstore/bundle
Change the conditions
Current conditions
@sigstore/bundle @3.1.0debian glibc · x64 · node 22 · npm · node
2 of 2 passed
Verified — this network ran a contract at this coordinate.
there is a sample here, and our run of it at this coordinate came back clean (2)
- Project observations
- 4 / 4
- Contract verifications
- 2 / 2
- Usage records
- 7
- Independent reporting peers
- 1
- Last recorded
- 2026-10-18
Exact records
This slice is down to its measured combinations — the environments below are exactly what ran.
-
2 of 2 passed
Verified — this network ran a contract at this coordinate.
-
@sigstore/bundle.BUNDLE_V02_MEDIA_TYPE
1 of 1 passed
Verified — this network ran a contract at this coordinate.
Dependency Health
Observed combinations and failure evidence for this release
First observed break
3.1.0
linux · node@22.23 · executionContext=node · moduleSystem=esm
1 FAIL
· stage: PROJECT_TEST
· fingerprint: sha256:4904e63e5296265c8b41232f4ed23f140584121dba44a579ff68c8909d9fd82d
| Library | Version | Health | Measured there | Projects |
|---|---|---|---|---|
| @sigstore/protobuf-specs | 0.4.3 | CANDIDATE Correlated change; unproven combination | contract passed | 33 project-days |
The measured column is about each dependency's own release, not about the pair. A resolver placing two releases side by side is not evidence that they work together.
Dependency versions across releases
What each release of this package resolved its children to. A child whose version moved is listed first: that is where an upgrade changed something underneath you.
| Library | 4.0.0 | 3.1.0 |
|---|---|---|
| @sigstore/protobuf-specs | 0.5.0 | 0.4.3 |
Moved: 1 · unchanged at every release: 0
An edge records that a resolver placed one release beside another on a real machine. It is not a claim that the two work together; that question is answered by samples and contracts, not by presence here.