@elastic/react-search-ui
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| maintainer-change | maintainer-added | AI (maintainer-change): Elastic org team rotation; new maintainers are Elastic-affiliated accounts. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Elastic org team rotation; removals consistent with legitimate maintainer transition. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Established Elastic monorepo package; sparse README/no keywords is a style choice, not spam. | ai | |
| provenance | no-provenance | AI (provenance): Large Elastic monorepo; lack of Sigstore provenance is consistent across their npm releases. | ai |
Versions (showing 10 of 10)
| Version | Deps | Published |
|---|---|---|
| 1.24.2 | 2 / 3 | |
| 1.23.1 | 2 / 3 | |
| 1.23.0 | 2 / 3 | |
| 1.22.2 | 2 / 4 | |
| 1.22.1 | 2 / 4 | |
| 1.22.0 | 2 / 4 | |
| 1.21.5 | 2 / 4 | |
| 1.21.4 | 2 / 4 | |
| 1.21.3 | 2 / 4 | |
| 1.21.2 | 2 / 4 |
v1.23.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (yan.savitski) than the most recent previously approved version (phoey1) on 2025-04-01, but yan.savitski is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.22.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.22.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.22.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (yan.savitski) than the most recent previously approved version (phoey1) on 2024-11-28, but yan.savitski is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.21.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.21.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.21.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.