@backstage/plugin-scaffolder
The Backstage plugin that helps you create new things
16
Versions
Apache-2.0
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
patrikofrebenmarcuseide
Keywords
backstage
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): Both new deps are legitimate: react-aria-components is Adobe's well-known a11y lib; @backstage/filter-predicates is same-org. | ai | |
| dependencies | unvetted-dep:zen-observable | AI (dependencies): zen-observable is a standard observable library; its use in Backstage scaffolder plugin is legitimate and stable across versions. | ai | |
| dependencies | unvetted-dep:@material-ui/lab | AI (dependencies): @material-ui/lab 4.0.0-alpha.61 is the standard pinned MUI v4 alpha used across Backstage; stable legitimate dependency. | ai | |
| dependencies | unvetted-dep:json-schema-library | AI (dependencies): json-schema-library is a legitimate JSON schema utility; used intentionally by this plugin for schema handling. | ai | |
| dependencies | unvetted-dep:@backstage/plugin-techdocs-common | AI (dependencies): First-party Backstage sibling package from the same monorepo; stable legitimate dependency. | ai | |
| dependencies | unvetted-dep:@backstage/plugin-scaffolder-react | AI (dependencies): First-party Backstage sibling package from the same monorepo; stable legitimate dependency. | ai | |
| phantom-deps | phantom-dep:json-schema-library | AI (phantom-deps): Declared dependency referenced in config files; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@backstage/integration | AI (phantom-deps): Same-org Backstage package; phantom-dep heuristic is unreliable for same-scope packages. | ai | |
| phantom-deps | phantom-dep:json-schema | AI (phantom-deps): Declared in package.json for config-driven use in this large Backstage plugin; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:git-url-parse | AI (phantom-deps): Declared dependency used in config files in this Backstage plugin; stable false positive. | ai | |
| phantom-deps | phantom-dep:react-resizable | AI (phantom-deps): Declared dependency referenced in config files; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@backstage/types | AI (phantom-deps): Same-org Backstage package; phantom-dep heuristic is unreliable for same-scope packages. | ai | |
| phantom-deps | phantom-dep:@rjsf/material-ui | AI (phantom-deps): Declared dependency referenced in config files; stable false positive for this package. | ai | |
| provenance | no-provenance | AI (provenance): Backstage monorepo publishes via CI without Sigstore provenance; absence is consistent across all versions and not a risk indicator for this package. | ai |