@grafana/o11y-ds-frontend
Shared UI components and utilities for observability datasource plugins in Grafana.
4
Versions
AGPL-3.0-only
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
gf_joshhuntgrafanabot
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| npm-metadata | suspicious-initial-version | AI (npm-metadata): Grafana monorepo packages routinely publish 0.0.0 as a placeholder; 1684 versions in registry confirms established package lifecycle. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Sparse metadata is typical for internal Grafana monorepo packages; not indicative of spam or malice. | ai | |
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): tslib is a known implicit runtime dep for TypeScript compiled output; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:react-select | AI (phantom-deps): react-select is referenced in config files; phantom-dep heuristic false positive for this package. | ai | |
| phantom-deps | phantom-dep:@grafana/e2e-selectors | AI (phantom-deps): Same-org dep used for type/selector references; stable false positive for this Grafana package. | ai |
Versions (showing 4 of 4)
| Version | Deps | Published |
|---|---|---|
| 13.0.2 | 11 / 17 | |
| 13.0.1 | 11 / 17 | |
| 13.0.0 | 11 / 17 | |
| 0.0.0 | 0 / 0 |
v13.0.2
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v13.0.0
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.0.0
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.