@ant-design/react-slick
React port of slick carousel
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-peer-dep:react-dom | AI (dependencies): react-dom is a required peer dependency for React components; standard and expected for this package. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Long dormancy followed by a coherent major version bump (v0.29.0 → v2.0.0) from a trusted Ant Design publisher with 2.6M weekly downloads. Consistent with planned major refactor, not account takeover. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): Maintainer expansion is typical for Ant Design ecosystem packages; no compromise indicators present. | ai | |
| dependencies | unvetted-dep:json2mq | AI (dependencies): json2mq is a stable, established media query parser; pre-existing dependency accepted in prior versions. | ai | |
| dependencies | unvetted-dep:resize-observer-polyfill | AI (dependencies): resize-observer-polyfill is a legitimate, widely-used polyfill for ResizeObserver API; appropriate for carousel component. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Maintainer removal in established project; afc163 remains as publisher with strong track record. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): New dependencies (resize-observer-polyfill, throttle-debounce) are established packages replacing older alternatives; appropriate refactoring. | ai | |
| provenance | no-provenance | AI (provenance): Provenance attestation is a best-practice recommendation; absence is not a security blocker for established packages. | ai |
Versions (showing 27 of 27)
| Version | Deps | Published |
|---|---|---|
| 2.0.0 | 4 / 55 | |
| 1.1.2 | 5 / 49 | |
| 1.1.1 | 5 / 49 | |
| 1.1.0 | 5 / 49 | |
| 1.0.2 | 5 / 49 | |
| 1.0.1 | 5 / 48 | |
| 1.0.0 | 5 / 48 | |
| 0.29.2 | 5 / 47 | |
| 0.29.1 | 5 / 47 | |
| 0.29.0 | 5 / 47 | |
| 0.28.4 | 5 / 51 | |
| 0.28.3 | 5 / 51 | |
| 0.28.2 | 5 / 51 | |
| 0.28.1 | 5 / 51 | |
| 0.28.0 | 5 / 51 | |
| 0.27.14 | 5 / 51 | |
| 0.27.13 | 5 / 51 | |
| 0.27.11 | 5 / 51 | |
| 0.27.10 | 5 / 51 | |
| 0.27.0 | 5 / 51 | |
| 0.26.3 | 5 / 51 | |
| 0.26.2 | 4 / 50 | |
| 0.26.1 | 4 / 50 | |
| 0.25.6 | 4 / 50 | |
| 0.25.5 | 4 / 50 | |
| 0.25.4 | 5 / 50 | |
| 0.25.3 | 5 / 50 |
v1.1.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.