From 37899779c8a8c90879dbf8285573e903c46040d6 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Tue, 22 Sep 2026 22:52:56 +0000 Subject: [PATCH] docs: correct provenance claim for current publishes Trusted CI publishes from 0.2.0 carry npm provenance. Attended local 0.1.1 tarballs do not. Co-authored-by: Saatvik Arya --- docs/releases.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/releases.md b/docs/releases.md index 73abd6a..5ba6d3c 100644 --- a/docs/releases.md +++ b/docs/releases.md @@ -31,7 +31,8 @@ npmjs.com must list GitHub Actions trusted publisher environment name. Do not rename `publish.yml`; npm pins that filename. This repository is public, so npm attaches provenance attestations to trusted -publishes. Current `0.1.1` tarballs were attended local publishes and have none. +publishes. Current trusted CI publishes (`0.2.0`+) carry provenance; attended +local `0.1.1` tarballs have none. The public packages version independently: