@jobber/components-native
React Native implementation of Atlantis
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| maintainer-change | maintainer-removed | AI (maintainer-change): Same rationale; org-managed package with rotating maintainers. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): Maintainer churn consistent with active Jobber org team, not a takeover pattern. | ai | |
| provenance | publisher-changed | AI (provenance): CI-shaped publisher account, provenance direction unchanged; consistent with automated releases. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Active component library; large file additions are routine for new component releases across 622 versions. | ai | |
| dependencies | unvetted-dep:react-native-modalize | AI (dependencies): react-native-modalize is a well-known RN modal library; appropriate for a RN component package. | ai | |
| dependencies | unvetted-dep:react-native-portalize | AI (dependencies): react-native-portalize is a companion to react-native-modalize; appropriate for a RN component package. | ai | |
| dependencies | unvetted-peer-dep:react-native-keyboard-controller | AI (dependencies): Stable peer dependency for this package; pre-existing and accepted. | ai | |
| dependencies | unvetted-dep:ts-xor | AI (dependencies): Legitimate TypeScript utility; stable dependency for this package. | ai | |
| dependencies | unvetted-dep:@react-native-clipboard/clipboard | AI (dependencies): Official React Native community clipboard package; well-known ecosystem dep. | ai | |
| dependencies | unvetted-dep:react-native-keyboard-controller | AI (dependencies): Popular React Native keyboard management library; no risk indicators. | ai | |
| dependencies | unvetted-dep:@react-native-picker/picker | AI (dependencies): Official React Native community picker package; well-known ecosystem dep. | ai | |
| provenance | no-provenance | AI (provenance): Established org package; lack of provenance is common and not a risk signal here. | ai |
Versions (showing 27 of 129)
| Version | Deps | Published |
|---|---|---|
| 0.73.2 | 14 / 9 | |
| 0.73.1 | 14 / 9 | |
| 0.73.0 | 14 / 12 | |
| 0.72.3 | 14 / 12 | |
| 0.72.2 | 14 / 12 | |
| 0.72.1 | 14 / 12 | |
| 0.72.0 | 14 / 12 | |
| 0.71.2 | 14 / 12 | |
| 0.71.1 | 14 / 12 | |
| 0.71.0 | 14 / 12 | |
| 0.70.0 | 14 / 12 | |
| 0.69.4 | 16 / 12 | |
| 0.69.3 | 16 / 12 | |
| 0.69.2 | 16 / 12 | |
| 0.69.1 | 16 / 12 | |
| 0.69.0 | 16 / 12 | |
| 0.68.0 | 16 / 12 | |
| 0.67.6 | 16 / 12 | |
| 0.67.5 | 16 / 12 | |
| 0.67.4 | 16 / 12 | |
| 0.67.3 | 16 / 12 | |
| 0.67.2 | 16 / 12 | |
| 0.67.1 | 16 / 12 | |
| 0.67.0 | 16 / 12 | |
| 0.66.2 | 16 / 12 | |
| 0.66.1 | 16 / 12 | |
| 0.66.0 | 16 / 12 |
v0.73.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.73.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.73.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.72.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.72.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.72.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.72.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.71.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.71.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.71.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.70.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.69.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.69.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.69.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.69.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.69.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.68.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.67.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.67.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.67.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.67.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.67.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.67.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.67.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.66.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.66.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.66.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.