@backstage/plugin-techdocs
The Backstage plugin that renders technical documentation for your components
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:jss | AI (phantom-deps): jss is a transitive Material-UI dependency; stable pattern for this package. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): New deps are @backstage/ui and @remixicon/react — both legitimate, well-known packages consistent with Backstage UI evolution. | ai | |
| dependencies | unvetted-dep:@remixicon/react | AI (dependencies): Legitimate icon library (@remixicon/react); no malicious signals. | ai | |
| dependencies | unvetted-dep:@material-ui/icons | AI (dependencies): Well-known Material UI icons package; standard dependency for Backstage frontend plugins. | ai | |
| dependencies | unvetted-dep:@backstage/plugin-search-react | AI (dependencies): First-party @backstage/* dependency from the official Backstage monorepo. | ai | |
| dependencies | unvetted-dep:@backstage/plugin-search-common | AI (dependencies): First-party @backstage/* dependency from the official Backstage monorepo. | ai | |
| dependencies | unvetted-dep:@backstage/theme | AI (dependencies): First-party @backstage/* dependency from the official Backstage monorepo; legitimate and expected for this plugin. | ai | |
| dependencies | unvetted-dep:@backstage/plugin-techdocs-common | AI (dependencies): First-party @backstage/* dependency; part of the same techdocs plugin family. | ai | |
| phantom-deps | phantom-dep:@backstage/theme | AI (phantom-deps): Same org scope; phantom dep pattern is common in Backstage monorepo plugins where theme tokens are used transitively. | ai | |
| provenance | no-provenance | AI (provenance): Established Backstage package with 2115 days history and 84.8k weekly downloads; lack of provenance is common and not disqualifying here. | ai | |
| dependencies | unvetted-dep:@backstage/plugin-techdocs-react | AI (dependencies): First-party @backstage/* dependency; part of the same techdocs plugin family. | ai | |
| dependencies | unvetted-dep:@material-ui/lab | AI (dependencies): Well-known Material UI lab package; standard dependency for Backstage frontend plugins using MUI v4. | ai |
Versions (showing 15 of 15)
| Version | Deps | Published |
|---|---|---|
| 1.17.6 | 29 / 15 | |
| 1.17.5 | 29 / 15 | |
| 1.17.4 | 29 / 15 | |
| 1.17.3 | 28 / 15 | |
| 1.17.2 | 28 / 15 | |
| 1.17.1 | 26 / 15 | |
| 1.17.0 | 26 / 15 | |
| 1.16.2 | 26 / 15 | |
| 1.16.1 | 26 / 15 | |
| 1.16.0 | 27 / 15 | |
| 1.15.2 | 28 / 15 | |
| 1.15.1 | 28 / 15 | |
| 1.14.1 | 28 / 15 | |
| 1.13.1 | 28 / 15 | |
| 1.12.6 | 28 / 15 |
v1.17.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.17.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.17.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.17.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.17.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.17.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.17.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.16.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.16.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.16.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.15.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.15.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.14.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.13.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.12.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.