@carbon/grid Apache-2.0 42 versions

@carbon/grid

npm Repository Homepage

Grid for digital and software products using the Carbon Design System

42

Versions

Apache-2.0

License

Yes

Install Scripts

Verified

Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

carbon-design-systemcarbon-botalisonjosephleechasejeffreychewsstrubbergtay1orjones

Keywords

eyeglass-moduleibmelementscarboncarbon-elementscarbon-design-systemcomponentsreact

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
publish-pattern	new-deps-added	AI (publish-pattern): Official IBM telemetry package, consistent across Carbon monorepo releases.	ai	2026/07/24
publish-pattern	dormant-publish	AI (publish-pattern): Carbon monorepo publishes in batches via CI; gaps between releases are normal for this package.	ai	2026/05/03
maintainer-change	maintainer-removed	AI (maintainer-change): Transition to GitHub Actions automated publishing explains maintainer removal; SLSA provenance confirms CI integrity.	ai	2026/05/03
install-scripts	install-script:postinstall	AI (install-scripts): IBM telemetry postinstall is standard across all @carbon/* packages; not malicious.	ai	2026/04/29
phantom-deps	phantom-dep:@ibm/telemetry-js	AI (phantom-deps): Referenced in telemetry.yml config for postinstall; not a JS import but legitimately used.	ai	2026/04/29
typosquat	typosquat.levenshtein:uuid	AI (typosquat): Scoped @carbon/grid package from IBM; Levenshtein match to uuid is a false positive.	ai	2026/04/29
phantom-deps	phantom-dep:@carbon/layout	AI (phantom-deps): Same-org SCSS dependency; not directly imported in JS but used as a SCSS dependency.	ai	2026/04/29

Versions (showing 42 of 42)

Version	Deps	Published
11.56.0	2 / 2	2026-05-20
11.55.0	2 / 2	2026-05-06
11.54.0	2 / 2	2026-04-22
11.53.0	2 / 2	2026-04-08
11.52.0	2 / 2	2026-03-25
11.48.0	2 / 2	2026-01-13
11.46.0	2 / 2	2025-12-03
11.45.0	2 / 2	2025-10-08
11.44.0	2 / 2	2025-09-24
11.43.0	2 / 2	2025-09-10
11.41.0	2 / 2	2025-08-13
11.40.0	2 / 2	2025-07-30
11.39.0	2 / 2	2025-07-16
11.38.0	2 / 2	2025-06-18
11.36.0	2 / 2	2025-05-07
11.23.0	2 / 2	2024-05-09
11.22.0	2 / 2	2024-03-13
11.21.1	1 / 2	2023-10-27
11.21.0	1 / 2	2023-10-26
11.20.0	1 / 2	2023-09-15
11.19.0	1 / 2	2023-08-17
11.18.0	1 / 2	2023-08-03
11.17.1	1 / 2	2023-07-27
11.17.0	1 / 2	2023-07-21
11.16.1	1 / 2	2023-07-07
11.16.0	1 / 2	2023-07-06
11.15.0	1 / 2	2023-06-08
11.14.0	1 / 2	2023-05-25
11.13.0	1 / 2	2023-04-13
11.12.0	1 / 2	2023-03-03
11.11.0	1 / 2	2023-01-19
11.10.0	1 / 2	2023-01-05
11.9.0	1 / 2	2022-12-08
11.8.0	1 / 2	2022-12-02
11.7.0	1 / 2	2022-09-29
11.6.0	1 / 2	2022-09-15
11.5.0	1 / 2	2022-08-04
11.4.0	1 / 2	2022-07-21
11.3.0	1 / 2	2022-06-09
11.2.0	1 / 2	2022-05-12
11.1.0	1 / 2	2022-04-14
11.0.0	1 / 2	2022-03-31

v11.23.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v11.22.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v11.21.1

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v11.21.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v11.20.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v11.19.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v11.18.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v11.17.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.17.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.16.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.16.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.15.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.14.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.13.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.12.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.11.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.10.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.9.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.8.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.7.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.6.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.5.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.4.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.3.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.