@backstage/plugin-user-settings
A Backstage plugin that provides a settings page
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:react-dom | AI (phantom-deps): React peer dep used implicitly via JSX; standard pattern for UI plugin packages. | ai | |
| dependencies | unvetted-dep:@backstage/core | AI (dependencies): Official first-party Backstage dependency, same org. | ai | |
| phantom-deps | phantom-dep:react-router | AI (phantom-deps): Used implicitly by routing components; common false positive for framework plugins. | ai | |
| dependencies | unvetted-dep:zen-observable | AI (dependencies): zen-observable is a legitimate, widely-used observable library; its use in this Backstage plugin is expected and stable across versions. | ai | |
| dependencies | unvetted-dep:@material-ui/lab | AI (dependencies): @material-ui/lab is the official Material-UI lab package; pinned alpha version is a long-standing stable dependency in Backstage plugins. | ai | |
| dependencies | unvetted-dep:@backstage/plugin-user-settings-common | AI (dependencies): Sibling package in the official Backstage monorepo; safe by definition for this package. | ai | |
| phantom-deps | phantom-dep:@backstage/catalog-model | AI (phantom-deps): Backstage monorepo plugin; @backstage/catalog-model is a sibling package. Phantom dep is a monorepo artifact, not a security concern. | ai | |
| phantom-deps | phantom-dep:@backstage/theme | AI (phantom-deps): Backstage monorepo plugin; @backstage/theme is a sibling package. Phantom dep is a monorepo artifact, not a security concern. | ai | |
| phantom-deps | phantom-dep:@backstage/plugin-user-settings-common | AI (phantom-deps): Backstage monorepo plugin; @backstage/plugin-user-settings-common is a sibling package. Phantom dep is a monorepo artifact, not a security concern. | ai | |
| provenance | no-provenance | AI (provenance): Backstage publishes from the official monorepo; lack of Sigstore provenance is consistent with their current CI pipeline and not a security risk for this well-established package. | ai | |
| phantom-deps | phantom-dep:@backstage/ui | AI (phantom-deps): Backstage monorepo plugin; @backstage/ui is a sibling package used conditionally or via re-exports. Not a security concern. | ai |
Versions (showing 12 of 12)
| Version | Deps | Published |
|---|---|---|
| 0.9.3 | 18 / 13 | |
| 0.9.2 | 18 / 13 | |
| 0.9.1 | 18 / 13 | |
| 0.9.0 | 17 / 13 | |
| 0.8.31 | 16 / 13 | |
| 0.8.30 | 16 / 13 | |
| 0.8.29 | 17 / 13 | |
| 0.8.22 | 17 / 13 | |
| 0.3.3 | 10 / 12 | |
| 0.2.11 | 9 / 11 | |
| 0.2.5 | 9 / 10 | |
| 0.1.1 | 9 / 10 |
v0.3.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.11
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.