volar-service-pug@0.0.71 is missing npm provenance attestation

[yyxi]

Hello, thank you for Volar!

volar-service-pug@0.0.71 appears to have been published without an npm provenance attestation. That causes pnpm install to fail in projects using trustPolicy: no-downgrade.

Evidence:

• volar-service-pug@0.0.70 has provenance attestation data
• volar-service-pug@0.0.71 has GitHub Actions trusted publisher metadata, but no provenance attestation
• the npm attestations endpoint for volar-service-pug@0.0.71 returns 404
• sibling volar-service-* packages at 0.0.71 do have provenance attestation

In pnpm 11, that shows up as:

  ERR_PNPM_TRUST_DOWNGRADE
  High-risk trust downgrade for "volar-service-pug@0.0.71" (possible package takeover)

This is reachable through the current Vue language server dependency chain:

• @vue/language-server
• @vue/language-service
• volar-service-pug@0.0.71