@floating-ui/react — Greenflagged

Floating UI for React

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

fezvrastaatomiks

tooltippopoverdropdownmenupopuppositioningreactreact-dom

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
publish-pattern	new-deps-added	AI (publish-pattern): @floating-ui/utils is a first-party package from the same floating-ui monorepo/publisher; adding it is an expected refactor, not a supply-chain risk.	ai	2026/04/23
dependencies	unvetted-peer-dep:react-dom	AI (dependencies): react-dom is a standard peer dependency for React libraries; unvetted peer dep status is expected and acceptable.	ai	2026/04/23
provenance	missing-githead	AI (provenance): atomiks is a long-standing trusted publisher with 440 approved packages; missing gitHead reflects a publish environment change, not a supply chain compromise signal for this package.	ai	2026/04/23
provenance	no-provenance	AI (provenance): Lack of Sigstore provenance is a process gap, not a security indicator, for this well-established package from a trusted publisher.	ai	2026/04/23
dependencies	unvetted-dep:@floating-ui/react-dom	AI (dependencies): @floating-ui/react-dom is a sibling package in the same ecosystem; unvetted status is expected and acceptable for this package.	ai	2026/04/21

View all versions

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.