@gooddata/sdk-ui-kit
GoodData SDK - UI Building Components
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | no-provenance | AI (provenance): Established publisher with long track record; provenance absence is low-risk for this package. | ai | |
| dependencies | unvetted-dep:@gooddata/number-formatter | AI (dependencies): First-party GoodData package; stable dependency across this package's versions. | ai | |
| email-domain | unclaimed-email:rodri360.com | AI (email-domain): Individual contributor email in a large org-managed GoodData monorepo; package published via gooddata-ci with strong track record. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): Large org package with frequent team changes; published via trusted CI account. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Routine team rotation in org-managed package. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Major version bump in active monorepo; 152 new files consistent with feature additions. | ai | |
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): tslib is a known implicit TypeScript runtime dependency; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:unified | AI (phantom-deps): unified is referenced in config/build tooling; not a direct import concern for this package. | ai | |
| phantom-deps | phantom-dep:@types/mdast | AI (phantom-deps): Type-only package loaded by convention; stable false positive. | ai | |
| phantom-deps | phantom-dep:@types/unist | AI (phantom-deps): Type-only package loaded by convention; stable false positive. | ai | |
| phantom-deps | phantom-dep:@floating-ui/dom | AI (phantom-deps): Referenced in config files; @floating-ui/react peer dependency pattern; stable false positive. | ai | |
| phantom-deps | phantom-dep:@floating-ui/react-dom | AI (phantom-deps): Referenced in config files; floating-ui ecosystem dependency; stable false positive. | ai |
Versions (showing 17 of 17)
| Version | Deps | Published |
|---|---|---|
| 11.49.0 | 46 / 51 | |
| 11.48.0 | 46 / 51 | |
| 11.47.0 | 46 / 51 | |
| 11.46.0 | 44 / 51 | |
| 11.43.0 | 44 / 51 | |
| 11.42.0 | 45 / 51 | |
| 11.40.0 | 45 / 51 | |
| 11.36.0 | 45 / 51 | |
| 11.32.0 | 45 / 51 | |
| 11.31.0 | 45 / 51 | |
| 11.22.0 | 45 / 51 | |
| 11.13.0 | 45 / 50 | |
| 11.7.1 | 45 / 50 | |
| 11.3.0 | 45 / 51 | |
| 11.2.0 | 45 / 51 | |
| 11.1.0 | 45 / 51 | |
| 11.0.0 | 45 / 51 |
v11.49.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.48.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.47.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.46.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.22.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.13.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.