@backstage/plugin-user-settings
A Backstage plugin that provides a settings page
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:zen-observable | AI (dependencies): zen-observable is a legitimate, widely-used observable library; its use in this Backstage plugin is expected and stable across versions. | ai | |
| dependencies | unvetted-dep:@material-ui/lab | AI (dependencies): @material-ui/lab is the official Material-UI lab package; pinned alpha version is a long-standing stable dependency in Backstage plugins. | ai | |
| dependencies | unvetted-dep:@backstage/plugin-user-settings-common | AI (dependencies): Sibling package in the official Backstage monorepo; safe by definition for this package. | ai | |
| phantom-deps | phantom-dep:@backstage/plugin-user-settings-common | AI (phantom-deps): Backstage monorepo plugin; @backstage/plugin-user-settings-common is a sibling package. Phantom dep is a monorepo artifact, not a security concern. | ai | |
| phantom-deps | phantom-dep:@backstage/ui | AI (phantom-deps): Backstage monorepo plugin; @backstage/ui is a sibling package used conditionally or via re-exports. Not a security concern. | ai | |
| provenance | no-provenance | AI (provenance): Backstage publishes from the official monorepo; lack of Sigstore provenance is consistent with their current CI pipeline and not a security risk for this well-established package. | ai | |
| phantom-deps | phantom-dep:@backstage/theme | AI (phantom-deps): Backstage monorepo plugin; @backstage/theme is a sibling package. Phantom dep is a monorepo artifact, not a security concern. | ai | |
| phantom-deps | phantom-dep:@backstage/catalog-model | AI (phantom-deps): Backstage monorepo plugin; @backstage/catalog-model is a sibling package. Phantom dep is a monorepo artifact, not a security concern. | ai |
Versions (showing 8 of 8)
| Version | Deps | Published |
|---|---|---|
| 0.9.3 | 18 / 13 | |
| 0.9.2 | 18 / 13 | |
| 0.9.1 | 18 / 13 | |
| 0.9.0 | 17 / 13 | |
| 0.8.31 | 16 / 13 | |
| 0.8.30 | 16 / 13 | |
| 0.8.29 | 17 / 13 | |
| 0.8.22 | 17 / 13 |
v0.9.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.9.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.9.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.9.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.8.31
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.8.30
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.8.29
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.8.22
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.