Records/npm/jose/failure issue

Where it was measured

PASS means the release recorded a passing observation at PROJECT_PROCESS and no record of this failure. That is the nearest thing to absence this network can report, not a proof of it.

• 6.2.10 PASS 17 passing observations
• 6.2.9 FAIL
• 6.2.8 FAIL
• 6.2.5 PASS 6 passing observations
• 6.2.4 FAIL
• 6.1.2 PASS 11 passing observations

Where it reproduced

• executionContext=node · moduleSystem=cjs · os=linux · runtime=node@22.23 ×3 2026-08-21 → 2026-08-21
• executionContext=node · moduleSystem=esm · os=windows · runtime=node@24.13 ×3 2026-08-14 → 2026-08-14

Nearest known PASS/FAIL boundaries

The two adjacent releases the verdict changes across. Releases nothing measured do not close the gap; they are counted instead.

• Last passing release 6.1.2 → first failing release 6.2.4

  Both trees resolved every dependency to the same version. Nothing here moved.

• Last failing release 6.2.4 → first passing release 6.2.5

  Both trees resolved every dependency to the same version. Nothing here moved.

• Last passing release 6.2.5 → first failing release 6.2.8

  Both trees resolved every dependency to the same version. Nothing here moved.

• Last failing release 6.2.9 → first passing release 6.2.10

  One side of this boundary has no resolved dependency tree, so nothing could be compared.

Evidence gaps

• The evidence for this failure was not preserved, so it has no established cause. Its stored hash is provenance, not an identity.
• No resolved dependency tree for 6.2.10 or for 6.2.9, so the versions either side of the boundary could not be compared.
• No failure domain was inferred for this failure.

Published answers for the affected releases

• jose 6.2.9: jwtDecrypt Built ? This network offers one thing: a sample that builds. It ran the sample in a sandbox and kept the signed receipt. It grades nothing and warrants nothing — whether the same code builds where you are is not something it measured. HOWjwtDecryptnode 22.23.2 MIT-0 · 2026-08-26
• jose 6.2.9: importJWK Built ? This network offers one thing: a sample that builds. It ran the sample in a sandbox and kept the signed receipt. It grades nothing and warrants nothing — whether the same code builds where you are is not something it measured. HOWimportJWKnode 22 MIT-0 · 2026-08-26
• jose 6.2.9: exportJWK Built ? This network offers one thing: a sample that builds. It ran the sample in a sandbox and kept the signed receipt. It grades nothing and warrants nothing — whether the same code builds where you are is not something it measured. HOWexportJWK MIT-0 · 2026-08-26
• jose 6.2.8 Built ? This network offers one thing: a sample that builds. It ran the sample in a sandbox and kept the signed receipt. It grades nothing and warrants nothing — whether the same code builds where you are is not something it measured. HOW MIT-0 · 2026-08-23
• jose 6.2.8: Verify an HS256 JWT with jose instead of jsonwebtoken, and handle its typed errors Built ? This network offers one thing: a sample that builds. It ran the sample in a sandbox and kept the signed receipt. It grades nothing and warrants nothing — whether the same code builds where you are is not something it measured. HOWSignJWTjwtVerifyjose.errorsUnsecuredJWTdecodeJwtnode 22 MIT-0 · 2026-08-14
• jose 6.2.4: SignJWT Built ? This network offers one thing: a sample that builds. It ran the sample in a sandbox and kept the signed receipt. It grades nothing and warrants nothing — whether the same code builds where you are is not something it measured. HOWjose.SignJWT MIT-0 · 2026-09-06