@codecademy/gamut
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/PatternBackdrop/PatternBackdrop.d.ts | AI (source-diff): Long lines are verbose TypeScript generic type declarations, not obfuscation. Stable pattern for this component library. | ai | |
| phantom-deps | phantom-dep:react-aria-tabpanel | AI (phantom-deps): Declared but not directly imported; consistent pattern for this package's dep management. | ai | |
| phantom-deps | phantom-dep:polished | AI (phantom-deps): Declared but not directly imported; stable false positive for this package. | ai | |
| source-diff | obfuscated-file:dist/DatePicker/DatePickerInput/elements.d.ts | AI (source-diff): Long lines are TypeScript declaration file with expanded union types — standard tsc output, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/DatePicker/DatePickerCalendar/Calendar/utils/elements.js | AI (source-diff): Long lines are Emotion CSS-in-JS with inline base64 source maps — standard build output, not obfuscation. | ai | |
| phantom-deps | phantom-dep:@codecademy/gamut-illustrations | AI (phantom-deps): Same-org package; declared as dep for consumers, not directly imported in this package's own code. | ai | |
| phantom-deps | phantom-dep:@react-aria/interactions | AI (phantom-deps): Referenced in config/overrides; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@types/marked | AI (phantom-deps): Type-only package; not directly imported at runtime by convention. | ai |
Versions (showing 54 of 54)
| Version | Deps | Published |
|---|---|---|
| 72.3.0 | 24 / 0 | |
| 72.2.5 | 24 / 0 | |
| 72.2.4 | 24 / 0 | |
| 72.2.3 | 24 / 0 | |
| 72.2.2 | 24 / 0 | |
| 72.2.1 | 24 / 0 | |
| 72.2.0 | 24 / 0 | |
| 72.1.0 | 24 / 0 | |
| 72.0.2 | 24 / 0 | |
| 72.0.1 | 24 / 0 | |
| 72.0.0 | 24 / 0 | |
| 71.0.0 | 24 / 0 | |
| 70.0.0 | 24 / 0 | |
| 69.0.0 | 24 / 0 | |
| 68.7.1 | 24 / 0 | |
| 68.7.0 | 24 / 0 | |
| 68.6.2 | 24 / 0 | |
| 68.6.1 | 24 / 0 | |
| 68.6.0 | 24 / 0 | |
| 68.5.1 | 24 / 0 | |
| 68.5.0 | 24 / 0 | |
| 68.4.1 | 24 / 0 | |
| 68.3.0 | 23 / 0 | |
| 68.1.4 | 23 / 0 | |
| 68.1.3 | 23 / 0 | |
| 68.1.2 | 23 / 0 | |
| 68.1.1 | 23 / 0 | |
| 68.1.0 | 23 / 0 | |
| 68.0.5 | 23 / 0 | |
| 68.0.4 | 24 / 0 | |
| 68.0.3 | 23 / 0 | |
| 68.0.2 | 23 / 0 | |
| 68.0.1 | 23 / 0 | |
| 68.0.0 | 23 / 0 | |
| 67.6.5 | 23 / 0 | |
| 67.6.4 | 23 / 0 | |
| 67.6.3 | 23 / 0 | |
| 67.6.2 | 23 / 0 | |
| 67.6.1 | 23 / 0 | |
| 67.6.0 | 23 / 0 | |
| 67.5.4 | 23 / 0 | |
| 67.5.3 | 23 / 0 | |
| 67.5.2 | 23 / 0 | |
| 67.5.1 | 23 / 0 | |
| 67.5.0 | 23 / 0 | |
| 67.4.2 | 23 / 0 | |
| 67.4.1 | 23 / 0 | |
| 67.4.0 | 23 / 0 | |
| 67.3.3 | 23 / 0 | |
| 67.3.2 | 23 / 0 | |
| 67.3.1 | 23 / 0 | |
| 67.3.0 | 23 / 0 | |
| 67.2.1 | 23 / 0 | |
| 67.2.0 | 23 / 0 |
v72.3.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v72.2.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v72.2.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v72.2.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.