@dxos/plugin-theme
DXOS Surface plugin for providing the application theme.
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@dxos/echo | AI (dependencies): Same-org monorepo dep pinned to matching version; consistent pattern across all DXOS packages. | ai | |
| dependencies | unvetted-dep:@dxos/app-toolkit | AI (dependencies): Same-org monorepo dep pinned to matching version; consistent pattern across all DXOS packages. | ai | |
| dependencies | unvetted-dep:@dxos/app-framework | AI (dependencies): Same-org monorepo dep pinned to matching version; consistent pattern across all DXOS packages. | ai | |
| phantom-deps | phantom-dep:@dxos/keys | AI (phantom-deps): Same-org dep; likely re-exported or used indirectly via monorepo barrel imports. | ai | |
| provenance | publisher-changed | AI (provenance): dxos-bot → GitHub Actions is a CI tooling migration; SLSA provenance attestation confirms legitimate pipeline publishing. | ai | |
| phantom-deps | phantom-dep:@dxos/operation | AI (phantom-deps): Same-org monorepo dep; phantom-dep heuristic unreliable for intra-monorepo packages. | ai | |
| phantom-deps | phantom-dep:@dxos/echo | AI (phantom-deps): Same-org monorepo dep; config-only reference is expected pattern for @dxos/* packages. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Sparse README and no keywords are consistent with internal DXOS monorepo tooling packages across all versions. | ai | |
| phantom-deps | phantom-dep:@dxos/util | AI (phantom-deps): Same-org monorepo dep; config-only reference is expected pattern for @dxos/* packages. | ai | |
| phantom-deps | phantom-dep:@dxos/echo-schema | AI (phantom-deps): Same-org monorepo dep; config-only reference is expected pattern for @dxos/* packages. | ai | |
| phantom-deps | phantom-dep:@preact-signals/safe-react | AI (phantom-deps): Config-only reference consistent with monorepo build tooling. | ai | |
| phantom-deps | phantom-dep:effect | AI (phantom-deps): Declared as both dep and peerDep; config-only reference is expected for this package type. | ai | |
| phantom-deps | phantom-dep:i18next | AI (phantom-deps): Config-only reference typical of i18n plugin packages in monorepos. | ai |
Versions (showing 17 of 17)
| Version | Deps | Published |
|---|---|---|
| 0.10.0 | 9 / 8 | |
| 0.9.0 | 8 / 8 | |
| 0.8.3 | 8 / 8 | |
| 0.8.2 | 8 / 8 | |
| 0.8.1 | 5 / 8 | |
| 0.8.0 | 5 / 8 | |
| 0.7.4 | 5 / 8 | |
| 0.7.3 | 5 / 8 | |
| 0.7.2 | 4 / 8 | |
| 0.7.1 | 4 / 8 | |
| 0.7.0 | 4 / 8 | |
| 0.6.13 | 4 / 8 | |
| 0.6.12 | 4 / 8 | |
| 0.6.11 | 4 / 8 | |
| 0.6.10 | 4 / 8 | |
| 0.6.9 | 3 / 8 | |
| 0.6.8 | 3 / 8 |
v0.10.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.8.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.8.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.7.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.7.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.7.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.7.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.7.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.6.13
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.6.12
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.6.11
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.6.10
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.6.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.6.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.