@chakra-ui/checkbox
A React Checkbox component for use in forms
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): Deps are official @chakra-ui/* packages from monorepo hook-splitting refactor. | ai | |
| provenance | missing-githead | AI (provenance): Monorepo publish variance, no malicious behavior indicated. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Established maintainer with strong history; dormancy alone isn't evidence of takeover. | ai | |
| phantom-deps | phantom-dep:@chakra-ui/hooks | AI (phantom-deps): Monorepo sibling dep, resolved via workspace, not actually unused. | ai | |
| phantom-deps | phantom-dep:@chakra-ui/visually-hidden | AI (phantom-deps): Monorepo sibling dep, resolved via workspace, not actually unused. | ai | |
| phantom-deps | phantom-dep:@chakra-ui/form-control | AI (phantom-deps): Monorepo sibling dep, resolved via workspace, not actually unused. | ai | |
| phantom-deps | phantom-dep:@chakra-ui/utils | AI (phantom-deps): Monorepo sibling dep, resolved via workspace, not actually unused. | ai | |
| phantom-deps | phantom-dep:@chakra-ui/react-utils | AI (phantom-deps): Monorepo sibling dep, resolved via workspace, not actually unused. | ai | |
| dependencies | unvetted-dep:@chakra-ui/react-use-controllable-state | AI (dependencies): First-party Chakra UI monorepo sub-package; stable false positive for this package. | ai | |
| dependencies | unvetted-dep:@chakra-ui/react-types | AI (dependencies): First-party Chakra UI monorepo sub-package; stable false positive for this package. | ai | |
| provenance | no-provenance | AI (provenance): Chakra UI predates widespread Sigstore adoption; absence of provenance is consistent across all versions. | ai | |
| dependencies | unvetted-dep:@chakra-ui/react-use-safe-layout-effect | AI (dependencies): First-party Chakra UI monorepo sub-package; stable false positive for this package. | ai | |
| dependencies | unvetted-dep:@chakra-ui/form-control | AI (dependencies): First-party Chakra UI monorepo sub-package; stable false positive for this package. | ai | |
| dependencies | unvetted-dep:@chakra-ui/shared-utils | AI (dependencies): First-party Chakra UI monorepo sub-package; stable false positive for this package. | ai | |
| dependencies | unvetted-dep:@chakra-ui/react-context | AI (dependencies): First-party Chakra UI monorepo sub-package; stable false positive for this package. | ai | |
| dependencies | unvetted-dep:@chakra-ui/visually-hidden | AI (dependencies): First-party Chakra UI monorepo sub-package; stable false positive for this package. | ai | |
| dependencies | unvetted-dep:@chakra-ui/react-use-merge-refs | AI (dependencies): First-party Chakra UI monorepo sub-package; stable false positive for this package. | ai | |
| dependencies | unvetted-dep:@chakra-ui/react-use-callback-ref | AI (dependencies): First-party Chakra UI monorepo sub-package; stable false positive for this package. | ai | |
| dependencies | unvetted-dep:@chakra-ui/react-use-update-effect | AI (dependencies): First-party Chakra UI monorepo sub-package; stable false positive for this package. | ai |
Versions (showing 31 of 31)
| Version | Deps | Published |
|---|---|---|
| 2.3.2 | 11 / 6 | |
| 2.3.1 | 11 / 6 | |
| 2.3.0 | 11 / 6 | |
| 2.2.15 | 11 / 6 | |
| 2.2.14 | 11 / 6 | |
| 2.2.13 | 11 / 6 | |
| 2.2.12 | 11 / 6 | |
| 2.2.11 | 11 / 6 | |
| 2.2.10 | 11 / 6 | |
| 2.2.9 | 11 / 6 | |
| 2.2.8 | 11 / 6 | |
| 2.2.7 | 11 / 6 | |
| 2.2.6 | 11 / 6 | |
| 2.2.5 | 10 / 7 | |
| 2.2.4 | 10 / 7 | |
| 2.2.3 | 10 / 7 | |
| 2.2.2 | 10 / 8 | |
| 2.2.1 | 10 / 8 | |
| 2.2.0 | 10 / 7 | |
| 2.1.8 | 10 / 7 | |
| 2.1.7 | 6 / 5 | |
| 2.1.6 | 6 / 5 | |
| 2.1.5 | 6 / 5 | |
| 2.1.4 | 6 / 5 | |
| 2.1.3 | 6 / 3 | |
| 2.1.2 | 6 / 3 | |
| 2.1.1 | 6 / 3 | |
| 2.1.0 | 6 / 3 | |
| 2.0.2 | 5 / 3 | |
| 2.0.1 | 5 / 3 | |
| 2.0.0 | 5 / 3 |
v2.3.1
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: segunadebayo.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.3.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: segunadebayo.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.2.14
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: segunadebayo.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.2.13
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: segunadebayo.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.2.12
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: segunadebayo.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.2.11
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: segunadebayo.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.2.10
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: segunadebayo.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.2.9
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: segunadebayo.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.2.8
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: segunadebayo.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.2.7
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: segunadebayo.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.2.6
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: segunadebayo.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.2.5
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: segunadebayo.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.2.4
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: segunadebayo.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.2.3
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: segunadebayo.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.2.2
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: segunadebayo.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.2.1
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: segunadebayo.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.2.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: segunadebayo.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.8
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: segunadebayo.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.7
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: segunadebayo.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.6
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: segunadebayo.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.5
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: segunadebayo.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.4
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: segunadebayo.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.