@instructure/ui-color-picker

A UI component library made by Instructure Inc.

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

jakeoedinginstuicimaths22jcrystalitadminsaogata-instpkovaacskyler-instructureericsaupexcudderjdewarjozsefg-instructurejacksonhowekaroly.bujtor.instructureevatapaisarahgerardkercsojforbidwolfbencefarkasodmehbvikingpingvinajmal-esarobinkuss64david.wenzlick.instrazorsh4rkardenabpjatacsukangela.gombanatearmstronginstjoyenjoyercguanzon-instherrtopimatyas.szabocjs118camraydmz985kristofkulcsarinstructure-npm-write-svc-accountmhulse_instsvetlintanyimhogensonppesti-instaaronshafszilard.doro-instmartongreczi-instinstoutsvcquizzesnpmbalazs.buri.instructuredaniel-torokfmarcsopeipeizhouis-adamszaborajmund-instdanny-instructure

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	large-new-source-files	AI (source-diff): Major version bump (v10→v11) in a large UI monorepo; new files expected.	ai	2026/05/18
provenance	missing-githead	AI (provenance): GitHub Actions publish environment change explains missing gitHead; SLSA attestation compensates for this gap.	ai	2026/05/18
maintainer-change	maintainer-added	AI (maintainer-change): New maintainers are Instructure org members; consistent with team rotation in a large org.	ai	2026/05/18
maintainer-change	maintainer-removed	AI (maintainer-change): Maintainer removal paired with additions is consistent with team rotation, not a takeover.	ai	2026/05/18
publish-pattern	new-deps-added	AI (publish-pattern): @instructure/ui-heading is a sibling monorepo package at the same pinned version; not a suspicious third-party dependency.	ai	2026/05/18
provenance	publisher-changed	AI (provenance): Instructure migrated publishing to GitHub Actions CI/CD; SLSA provenance attestation confirms integrity.	ai	2026/05/18
dependencies	unvetted-dep:@instructure/ui-themes	AI (dependencies): Sibling monorepo package pinned to same version; expected pattern for @instructure/* releases.	ai	2026/04/29
dependencies	unvetted-dep:@instructure/ui-buttons	AI (dependencies): Sibling monorepo package pinned to same version; expected pattern for @instructure/* releases.	ai	2026/04/29
dependencies	unvetted-dep:@instructure/ui-heading	AI (dependencies): Sibling monorepo package pinned to same version; expected pattern for @instructure/* releases.	ai	2026/04/29
dependencies	unvetted-dep:@instructure/ui-popover	AI (dependencies): Sibling monorepo package pinned to same version; expected pattern for @instructure/* releases.	ai	2026/04/29
dependencies	unvetted-dep:@instructure/ui-tooltip	AI (dependencies): Sibling monorepo package pinned to same version; expected pattern for @instructure/* releases.	ai	2026/04/29
dependencies	unvetted-dep:@instructure/ui-dom-utils	AI (dependencies): Sibling monorepo package pinned to same version; expected pattern for @instructure/* releases.	ai	2026/04/29
dependencies	unvetted-dep:@instructure/emotion	AI (dependencies): Sibling monorepo package pinned to same version; expected pattern for @instructure/* releases.	ai	2026/04/29
dependencies	unvetted-dep:@instructure/ui-form-field	AI (dependencies): Sibling monorepo package pinned to same version; expected pattern for @instructure/* releases.	ai	2026/04/29
dependencies	unvetted-dep:@instructure/ui-text-input	AI (dependencies): Sibling monorepo package pinned to same version; expected pattern for @instructure/* releases.	ai	2026/04/29
dependencies	unvetted-dep:@instructure/ui-color-utils	AI (dependencies): Sibling monorepo package pinned to same version; expected pattern for @instructure/* releases.	ai	2026/04/29
dependencies	unvetted-dep:@instructure/ui-react-utils	AI (dependencies): Sibling monorepo package pinned to same version; expected pattern for @instructure/* releases.	ai	2026/04/29
dependencies	unvetted-dep:@instructure/ui-a11y-content	AI (dependencies): Sibling monorepo package pinned to same version; expected pattern for @instructure/* releases.	ai	2026/04/29
dependencies	unvetted-dep:@instructure/ui-drilldown	AI (dependencies): Sibling monorepo package pinned to same version; expected pattern for @instructure/* releases.	ai	2026/04/29
dependencies	unvetted-dep:@instructure/ui-pill	AI (dependencies): Sibling monorepo package pinned to same version; expected pattern for @instructure/* releases.	ai	2026/04/29
dependencies	unvetted-dep:@instructure/ui-text	AI (dependencies): Sibling monorepo package pinned to same version; expected pattern for @instructure/* releases.	ai	2026/04/29
dependencies	unvetted-dep:@instructure/ui-view	AI (dependencies): Sibling monorepo package pinned to same version; expected pattern for @instructure/* releases.	ai	2026/04/29
dependencies	unvetted-dep:@instructure/ui-icons	AI (dependencies): Sibling monorepo package pinned to same version; expected pattern for @instructure/* releases.	ai	2026/04/29
dependencies	unvetted-dep:@instructure/ui-utils	AI (dependencies): Sibling monorepo package pinned to same version; expected pattern for @instructure/* releases.	ai	2026/04/29

Versions (showing 15 of 15)

Version	Deps	Published
11.7.3	21 / 7	2026-05-07
11.7.2	21 / 7	2026-04-24
11.7.1	21 / 7	2026-03-20
11.7.0	21 / 7	2026-03-18
11.6.0	21 / 7	2026-02-18
11.5.0	21 / 7	2026-02-03
11.4.0	21 / 7	2026-01-20
11.3.0	20 / 7	2026-01-12
11.2.0	20 / 7	2025-11-06
11.0.1	20 / 7	2025-10-13
11.0.0	20 / 7	2025-10-06
10.30.0	22 / 7	2026-02-20
10.29.0	22 / 7	2026-01-15
10.26.4	22 / 7	2025-11-20
10.26.3	22 / 7	2025-11-20

v11.7.3

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.7.1

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.

HIGH Publisher changed: matyas.szabo → GitHub Actions (on 2026-03-20) provenance

This version was published by a different npm account than previous versions on 2026-03-20. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.7.0

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.

HIGH Publisher changed: matyas.szabo → GitHub Actions (on 2026-03-18) provenance

This version was published by a different npm account than previous versions on 2026-03-18. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.6.0

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.

HIGH Publisher changed: matyas.szabo → GitHub Actions (on 2026-02-18) provenance

This version was published by a different npm account than previous versions on 2026-02-18. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.5.0

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.

HIGH Publisher changed: matyas.szabo → GitHub Actions (on 2026-02-03) provenance

This version was published by a different npm account than previous versions on 2026-02-03. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.4.0

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.

HIGH Publisher changed: matyas.szabo → GitHub Actions (on 2026-01-20) provenance

This version was published by a different npm account than previous versions on 2026-01-20. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.3.0

2 findings

HIGH Publisher changed: matyas.szabo → GitHub Actions (on 2026-01-12) provenance

This version was published by a different npm account than previous versions on 2026-01-12. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v11.0.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v10.30.0

2 findings

HIGH Publisher changed: matyas.szabo → GitHub Actions (on 2026-02-20) provenance

This version was published by a different npm account than previous versions on 2026-02-20. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.29.0

2 findings

HIGH Publisher changed: matyas.szabo → GitHub Actions (on 2026-01-15) provenance

This version was published by a different npm account than previous versions on 2026-01-15. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.26.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.26.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.