Would you consider bumping the oxc-parser dependency to >=0.90.0? At 0.76.0 its platform bindings publish without build provenance, which makes anything depending on componentize-js uninstallable under an installer that enforces provenance.
Filed here at the jco maintainers' suggestion — this started as bytecodealliance/jco#1841, and the reply was that the dependency needs updating here first.
The chain is jco@1.27.0 → @bytecodealliance/componentize-js@^0.22.0 → oxc-parser@^0.76.0. All 15 @oxc-parser/binding-* packages at 0.76.0 are missing build provenance attestations, while oxc-parser and @oxc-project/types at the same version have them.
It looks like a gap in one range rather than the norm: @oxc-parser/binding-darwin-arm64 has attestations at 0.13.3, none at 0.76.0, and has them again from 0.90.0 through the current 0.143.0. npm registry signatures are present throughout — build provenance specifically is what is missing.
Installers that enforce provenance and treat a loss of attestation as a downgrade refuse the install outright. It is not host-specific either: the resolver walks every optional binding, so all 15 have to be excluded individually to get past it, including the 13 for platforms a given project will never run.
Bumping to >=0.90.0 would let componentize-js and jco install cleanly under those policies with no per-package exceptions.
Would you consider bumping the
oxc-parserdependency to>=0.90.0? At0.76.0its platform bindings publish without build provenance, which makes anything depending on componentize-js uninstallable under an installer that enforces provenance.Filed here at the jco maintainers' suggestion — this started as bytecodealliance/jco#1841, and the reply was that the dependency needs updating here first.
The chain is
jco@1.27.0→@bytecodealliance/componentize-js@^0.22.0→oxc-parser@^0.76.0. All 15@oxc-parser/binding-*packages at0.76.0are missing build provenance attestations, whileoxc-parserand@oxc-project/typesat the same version have them.It looks like a gap in one range rather than the norm:
@oxc-parser/binding-darwin-arm64has attestations at0.13.3, none at0.76.0, and has them again from0.90.0through the current0.143.0. npm registry signatures are present throughout — build provenance specifically is what is missing.Installers that enforce provenance and treat a loss of attestation as a downgrade refuse the install outright. It is not host-specific either: the resolver walks every optional binding, so all 15 have to be excluded individually to get past it, including the 13 for platforms a given project will never run.
Bumping to
>=0.90.0would let componentize-js and jco install cleanly under those policies with no per-package exceptions.