← Home

@gooddata/sdk-ui-charts

npm Repository Homepage

GoodData.UI SDK - Charts

31
Versions
LicenseRef-LICENSE
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

rodri360ivan.mjartanlupkotomas.kratochvilrodrigo.balsellsstanislavhackervojtasiipbenesgooddata-cinikolacechpetrjanuhung.caoxmortbich.nguyenno23reasonmatyas.kandlromanrakustu.buimy.duonghang.ngoscavnickyjthao-luongthuong.nguyenhuyen.nguyennestor_encinastmuchkagdjanphong.nguyentuan.tran_gdmkoldusmartin.milickapjiranekmartozardavid.zoufalyagrebnevs-gdvasek.zmrhalhkad98hoaimylukas.therondrejvelisekgdamilietaandrenanninga-gooddatapavelzrkilianchikdusan-kovacik-profiqkhuongnguyenmatej.pavlikjenny_gooddatagoodkubaarmhajbertold8jyn.nguyenmara3londrej.macapetr.veprekjan.tychtl.gooddatatimurmuhdanieldoktorjkbmmilan.dufekmaitrieuphilongjkbm_gdzdenekornstjiri.starobahenry.nguyen.gooddataadam.prchalfrankhuynhmacekondmartinnajpeter.kozasandrasuspjarjan.svager.gooddataminh.ho.gooddatamaiphuong.buijakubz_goodpavelcernymvarhalikhankadev

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance no-provenance AI (provenance): Established package with stable publish pattern; provenance adoption is a future improvement, not a blocker. ai
maintainer-change maintainer-removed AI (maintainer-change): GoodData org package published via CI; individual maintainer rotation is expected and not indicative of takeover. ai
maintainer-change maintainer-added AI (maintainer-change): Active GoodData org; maintainer additions are routine team changes, not indicative of compromise. ai
dependencies unvetted-dep:@gooddata/number-formatter AI (dependencies): Same org (@gooddata) as this package; publisher has strong track record with 318 approved packages. ai
email-domain unclaimed-email:rodri360.com AI (email-domain): Stale maintainer email on a well-established GoodData org package; not an active hijack risk given CI-managed publishing. ai
phantom-deps phantom-dep:@gooddata/util AI (phantom-deps): Same-org package, likely used transitively; stable false positive for this monorepo package. ai
phantom-deps phantom-dep:tslib AI (phantom-deps): tslib is a known implicit TypeScript runtime dep; stable false positive for this package. ai

Versions (showing 31 of 31)

Version Deps Published
11.49.0 26 / 47
11.48.0 26 / 47
11.46.0 26 / 47
11.43.0 26 / 47
11.42.0 26 / 47
11.40.0 26 / 47
11.38.0 26 / 47
11.37.0 26 / 47
11.36.0 26 / 47
11.33.0 26 / 47
11.32.0 26 / 47
11.31.0 26 / 47
11.30.0 26 / 47
11.29.0 26 / 47
11.28.0 26 / 47
11.27.0 26 / 47
11.26.0 26 / 47
11.25.0 26 / 47
11.24.0 26 / 47
11.23.0 26 / 47
11.22.0 26 / 47
11.21.0 26 / 47
11.20.0 26 / 47
11.19.0 26 / 46
11.17.0 26 / 46
11.16.0 26 / 46
11.13.0 26 / 46
11.12.0 26 / 46
11.10.0 26 / 46
11.9.0 26 / 46
11.8.0 26 / 46

v11.49.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.48.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.46.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.25.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.