@instructure/ui-top-nav-bar

A UI component library made by Instructure Inc.

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

jakeoedinginstuicimaths22jcrystalitadminsaogata-instpkovaacskyler-instructureericsaupexcudderjdewarjozsefg-instructurejacksonhowekaroly.bujtor.instructureevatapaisarahgerardkercsojforbidwolfbencefarkasodmehbvikingpingvinajmal-esarobinkuss64david.wenzlick.instrazorsh4rkardenabpjatacsukangela.gombanatearmstronginstjoyenjoyercguanzon-instherrtopimatyas.szabocjs118camraydmz985kristofkulcsarinstructure-npm-write-svc-accountmhulse_instsvetlintanyimhogensonppesti-instaaronshafszilard.doro-instmartongreczi-instinstoutsvcquizzesnpmbalazs.buri.instructuredaniel-torokfmarcsopeipeizhouis-adamszaborajmund-instdanny-instructure

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
provenance	missing-githead	AI (provenance): Instructure migrated to GitHub Actions CI with SLSA attestation; gitHead absence is expected in this publish flow.	ai	2026/05/18
maintainer-change	maintainer-added	AI (maintainer-change): Maintainer roster changes consistent with org-level CI/CD migration; not indicative of takeover.	ai	2026/05/18
maintainer-change	maintainer-removed	AI (maintainer-change): Removal of individual maintainer consistent with transition to automated publishing; no malicious signal.	ai	2026/05/18
publish-pattern	new-deps-added	AI (publish-pattern): All three new deps are well-known packages (prop-types) or same-org Instructure UI packages; not suspicious.	ai	2026/05/18
provenance	publisher-changed	AI (provenance): Instructure migrated publishing to GitHub Actions CI/CD with SLSA attestation; stable pattern for this org's packages.	ai	2026/05/18
dependencies	unvetted-dep:@instructure/ui-utils	AI (dependencies): Sibling monorepo package; same version pinning is expected for @instructure/* releases.	ai	2026/04/29
dependencies	unvetted-dep:@instructure/ui-avatar	AI (dependencies): Sibling monorepo package; same version pinning is expected for @instructure/* releases.	ai	2026/04/29
dependencies	unvetted-dep:@instructure/ui-dialog	AI (dependencies): Sibling monorepo package; same version pinning is expected for @instructure/* releases.	ai	2026/04/29
dependencies	unvetted-dep:@instructure/ui-buttons	AI (dependencies): Sibling monorepo package; same version pinning is expected for @instructure/* releases.	ai	2026/04/29
dependencies	unvetted-dep:@instructure/ui-popover	AI (dependencies): Sibling monorepo package; same version pinning is expected for @instructure/* releases.	ai	2026/04/29
dependencies	unvetted-dep:@instructure/ui-tooltip	AI (dependencies): Sibling monorepo package; same version pinning is expected for @instructure/* releases.	ai	2026/04/29
dependencies	unvetted-dep:@instructure/emotion	AI (dependencies): Sibling monorepo package; same version pinning is expected for @instructure/* releases.	ai	2026/04/29
dependencies	unvetted-dep:@instructure/ui-breadcrumb	AI (dependencies): Sibling monorepo package; same version pinning is expected for @instructure/* releases.	ai	2026/04/29
dependencies	unvetted-dep:@instructure/ui-responsive	AI (dependencies): Sibling monorepo package; same version pinning is expected for @instructure/* releases.	ai	2026/04/29
dependencies	unvetted-dep:@instructure/ui-react-utils	AI (dependencies): Sibling monorepo package; same version pinning is expected for @instructure/* releases.	ai	2026/04/29
dependencies	unvetted-dep:@instructure/ui-a11y-content	AI (dependencies): Sibling monorepo package; same version pinning is expected for @instructure/* releases.	ai	2026/04/29
dependencies	unvetted-dep:@instructure/ui-truncate-list	AI (dependencies): Sibling monorepo package; same version pinning is expected for @instructure/* releases.	ai	2026/04/29
dependencies	unvetted-dep:@instructure/ui-drilldown	AI (dependencies): Sibling monorepo package; same version pinning is expected for @instructure/* releases.	ai	2026/04/29
dependencies	unvetted-dep:@instructure/ui-link	AI (dependencies): Sibling monorepo package; same version pinning is expected for @instructure/* releases.	ai	2026/04/29
dependencies	unvetted-dep:@instructure/ui-tray	AI (dependencies): Sibling monorepo package; same version pinning is expected for @instructure/* releases.	ai	2026/04/29
dependencies	unvetted-dep:@instructure/ui-view	AI (dependencies): Sibling monorepo package; same version pinning is expected for @instructure/* releases.	ai	2026/04/29
dependencies	unvetted-dep:@instructure/ui-icons	AI (dependencies): Sibling monorepo package; same version pinning is expected for @instructure/* releases.	ai	2026/04/29

Versions (showing 15 of 15)

Version	Deps	Published
11.7.3	22 / 8	2026-05-07
11.7.2	21 / 9	2026-04-24
11.7.1	21 / 9	2026-03-20
11.7.0	21 / 9	2026-03-18
11.6.0	21 / 9	2026-02-18
11.5.0	21 / 9	2026-02-03
11.4.0	21 / 9	2026-01-20
11.3.0	21 / 9	2026-01-12
11.2.0	21 / 9	2025-11-06
11.0.1	21 / 9	2025-10-13
11.0.0	21 / 9	2025-10-06
10.30.0	24 / 9	2026-02-20
10.29.0	24 / 9	2026-01-15
10.26.4	24 / 9	2025-11-20
10.26.3	24 / 9	2025-11-20

v11.7.3

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.7.1

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.

HIGH Publisher changed: matyas.szabo → GitHub Actions (on 2026-03-20) provenance

This version was published by a different npm account than previous versions on 2026-03-20. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.7.0

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.

HIGH Publisher changed: matyas.szabo → GitHub Actions (on 2026-03-18) provenance

This version was published by a different npm account than previous versions on 2026-03-18. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.6.0

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.

HIGH Publisher changed: matyas.szabo → GitHub Actions (on 2026-02-18) provenance

This version was published by a different npm account than previous versions on 2026-02-18. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.5.0

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.

HIGH Publisher changed: matyas.szabo → GitHub Actions (on 2026-02-03) provenance

This version was published by a different npm account than previous versions on 2026-02-03. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.4.0

2 findings

HIGH Publisher changed: matyas.szabo → GitHub Actions (on 2026-01-20) provenance

This version was published by a different npm account than previous versions on 2026-01-20. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.3.0

2 findings

HIGH Publisher changed: matyas.szabo → GitHub Actions (on 2026-01-12) provenance

This version was published by a different npm account than previous versions on 2026-01-12. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v11.0.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v11.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v10.30.0

2 findings

HIGH Publisher changed: matyas.szabo → GitHub Actions (on 2026-02-20) provenance

This version was published by a different npm account than previous versions on 2026-02-20. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.29.0

2 findings

HIGH Publisher changed: matyas.szabo → GitHub Actions (on 2026-01-15) provenance

This version was published by a different npm account than previous versions on 2026-01-15. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.26.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.26.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.