@grafana/components
Product Design Engineering Components for Grafana
15
Versions
Apache-2.0
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
gf_joshhuntgrafanabot
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | missing-githead | AI (provenance): Grafana's CI pipeline change explains missing gitHead; consistent with other build script changes in this version. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): clsx is a well-established, widely-used utility; no malicious history or supply chain risk. | ai | |
| phantom-deps | phantom-dep:clsx | AI (phantom-deps): clsx is a well-known utility; phantom-dep fires because it's referenced in config/build files rather than directly imported in source. | ai | |
| dependencies | unvetted-dep:@grafana/data | AI (dependencies): First-party Grafana package; stable dependency for this Grafana component library. | ai | |
| dependencies | unvetted-dep:@grafana/design-tokens | AI (dependencies): First-party Grafana design system package; expected dependency for this library. | ai | |
| dependencies | unvetted-dep:react-useportal | AI (dependencies): Well-known React portal utility; low risk for a UI component library. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Size increase driven by icon asset files (iconMetaData.js, allIcons.js) added in this version; expected for a component library. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Growth attributable to icon data assets and rollup build output; not injected payload. | ai | |
| phantom-deps | phantom-dep:@grafana/data | AI (phantom-deps): Same-org @grafana/data; declared as peer/dep in a component library, phantom-dep heuristic is a stable false positive here. | ai | |
| provenance | no-provenance | AI (provenance): Grafana org package published via grafanabot; provenance absence is common and not a risk signal here. | ai | |
| phantom-deps | phantom-dep:@emotion/react | AI (phantom-deps): @emotion/react is a declared runtime dep used in build/config context; phantom-dep heuristic false positive for this package. | ai | |
| phantom-deps | phantom-dep:react-useportal | AI (phantom-deps): Declared runtime dep; phantom-dep heuristic false positive for this package. | ai |