@gooddata/sdk-ui-ext
GoodData.UI SDK - Extensions
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| maintainer-change | maintainer-added | AI (maintainer-change): Active GoodData org; maintainer additions are routine team changes for this large SDK. | ai | |
| dependencies | unvetted-dep:react-select-async-paginate | AI (dependencies): react-select-async-paginate is a well-known pagination extension for react-select; stable dependency for this package. | ai | |
| email-domain | unclaimed-email:rodri360.com | AI (email-domain): Stale maintainer email on a long-established GoodData monorepo package; active publishing is via gooddata-ci CI account with clean track record. | ai | |
| phantom-deps | phantom-dep:@lezer/highlight | AI (phantom-deps): CodeMirror ecosystem dep; used transitively by @codemirror/* packages, stable FP. | ai | |
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): tslib is a standard TypeScript runtime helper; declared as dep, used transitively by compiled output. | ai | |
| phantom-deps | phantom-dep:react-loading-skeleton | AI (phantom-deps): Declared runtime dep; stable FP for this package. | ai | |
| phantom-deps | phantom-dep:fixed-data-table-2 | AI (phantom-deps): Declared runtime dep for table rendering; stable FP for this package. | ai | |
| phantom-deps | phantom-dep:moment | AI (phantom-deps): moment is a declared runtime dep used via config/indirect imports; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:date-fns | AI (phantom-deps): date-fns declared as runtime dep; phantom-dep heuristic fires on config-only references, stable FP. | ai |
Versions (showing 13 of 13)
| Version | Deps | Published |
|---|---|---|
| 11.40.0 | 42 / 51 | |
| 11.39.0 | 42 / 51 | |
| 11.38.0 | 42 / 51 | |
| 11.37.0 | 42 / 51 | |
| 11.36.0 | 42 / 51 | |
| 11.35.0 | 42 / 51 | |
| 11.34.0 | 42 / 51 | |
| 11.33.0 | 42 / 51 | |
| 11.32.0 | 42 / 51 | |
| 11.31.0 | 41 / 51 | |
| 11.30.0 | 41 / 51 | |
| 11.29.0 | 41 / 51 | |
| 11.28.0 | 41 / 51 |
v11.40.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.39.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.38.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.37.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.36.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.35.0
2 findingsMaintainer email '[email protected]' uses domain 'rodri360.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.34.0
2 findingsMaintainer email '[email protected]' uses domain 'rodri360.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.33.0
2 findingsMaintainer email '[email protected]' uses domain 'rodri360.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.31.0
2 findingsMaintainer email '[email protected]' uses domain 'rodri360.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v11.30.0
2 findingsMaintainer email '[email protected]' uses domain 'rodri360.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v11.29.0
2 findingsMaintainer email '[email protected]' uses domain 'rodri360.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v11.28.0
2 findingsMaintainer email '[email protected]' uses domain 'rodri360.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.