@lobehub/ui
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | no-provenance | AI (provenance): Established high-download package; provenance absence is consistent across all prior versions. | ai | |
| dependencies | unvetted-dep:react-layout-kit | AI (dependencies): Legitimate layout utility used by this UI library; consistent across versions. | ai | |
| dependencies | unvetted-dep:@lobehub/fluent-emoji | AI (dependencies): First-party @lobehub scoped emoji package; consistent with this library's purpose. | ai | |
| phantom-deps | phantom-dep:@floating-ui/react | AI (phantom-deps): Peer/optional dep pattern common in UI component libraries; stable false positive. | ai | |
| typosquat | typosquat.levenshtein:yup | AI (typosquat): Scoped package @lobehub/ui; Levenshtein match to yup is a false positive. | ai | |
| phantom-deps | phantom-dep:uuid | AI (phantom-deps): Large UI library; deps referenced in config/re-exports are expected not to be directly imported in source. | ai | |
| phantom-deps | phantom-dep:rc-image | AI (phantom-deps): Large UI library; config-only reference is expected pattern. | ai | |
| phantom-deps | phantom-dep:emoji-mart | AI (phantom-deps): Large UI library; config-only reference is expected pattern. | ai | |
| phantom-deps | phantom-dep:query-string | AI (phantom-deps): Large UI library; config-only reference is expected pattern. | ai | |
| typosquat | typosquat.levenshtein:uuid | AI (typosquat): Scoped package @lobehub/ui; Levenshtein match to uuid is a false positive. | ai | |
| phantom-deps | phantom-dep:remark-github | AI (phantom-deps): Large UI library; config-only reference is expected pattern. | ai | |
| phantom-deps | phantom-dep:@ant-design/cssinjs | AI (phantom-deps): Large UI library; config-only reference is expected pattern. | ai | |
| phantom-deps | phantom-dep:@radix-ui/react-slot | AI (phantom-deps): Large UI library; config-only reference is expected pattern. | ai | |
| phantom-deps | phantom-dep:react-zoom-pan-pinch | AI (phantom-deps): Large UI library; config-only reference is expected pattern. | ai | |
| phantom-deps | phantom-dep:@emotion/is-prop-valid | AI (phantom-deps): Large UI library; config-only reference is expected pattern. | ai | |
| phantom-deps | phantom-dep:@mdx-js/react | AI (phantom-deps): Large UI library; config-only reference is expected pattern. | ai | |
| typosquat | typosquat.levenshtein:pg | AI (typosquat): Scoped package @lobehub/ui; Levenshtein match to pg is a false positive. | ai | |
| typosquat | typosquat.levenshtein:qs | AI (typosquat): Scoped package @lobehub/ui; Levenshtein match to qs is a false positive. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): Scoped package @lobehub/ui; Levenshtein match to joi is a false positive. | ai |
Versions (showing 51 of 272)
| Version | Deps | Published |
|---|---|---|
| 5.24.0 | 73 / 66 | |
| 5.23.5 | 73 / 67 | |
| 5.23.4 | 73 / 67 | |
| 5.23.3 | 73 / 67 | |
| 5.23.2 | 73 / 67 | |
| 5.23.1 | 73 / 67 | |
| 5.23.0 | 73 / 67 | |
| 5.22.3 | 73 / 67 | |
| 5.22.2 | 73 / 67 | |
| 5.22.1 | 73 / 67 | |
| 5.22.0 | 73 / 67 | |
| 5.21.0 | 73 / 67 | |
| 5.20.3 | 73 / 55 | |
| 5.20.2 | 73 / 55 | |
| 5.20.1 | 73 / 55 | |
| 5.20.0 | 73 / 55 | |
| 5.19.3 | 73 / 54 | |
| 5.19.2 | 73 / 54 | |
| 5.19.1 | 73 / 54 | |
| 5.19.0 | 73 / 54 | |
| 5.18.0 | 73 / 54 | |
| 5.17.2 | 73 / 54 | |
| 5.17.1 | 73 / 54 | |
| 5.17.0 | 73 / 54 | |
| 5.16.2 | 73 / 54 | |
| 5.16.1 | 73 / 54 | |
| 5.16.0 | 73 / 54 | |
| 5.15.17 | 73 / 54 | |
| 5.15.16 | 68 / 54 | |
| 5.15.15 | 68 / 54 | |
| 5.15.14 | 68 / 54 | |
| 5.15.13 | 68 / 54 | |
| 5.15.12 | 68 / 54 | |
| 5.15.11 | 68 / 54 | |
| 5.15.10 | 68 / 54 | |
| 5.15.9 | 68 / 54 | |
| 5.15.8 | 68 / 54 | |
| 5.15.7 | 68 / 54 | |
| 5.15.6 | 68 / 54 | |
| 5.15.5 | 68 / 54 | |
| 5.15.4 | 68 / 54 | |
| 5.15.3 | 68 / 54 | |
| 5.15.2 | 68 / 54 | |
| 5.15.1 | 68 / 54 | |
| 5.15.0 | 68 / 54 | |
| 5.14.2 | 68 / 54 | |
| 5.14.1 | 68 / 54 | |
| 5.14.0 | 68 / 54 | |
| 5.13.0 | 68 / 54 | |
| 5.12.3 | 68 / 54 | |
| 5.12.2 | 68 / 54 |
v5.24.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.23.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.23.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.23.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.23.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.23.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.23.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.22.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.22.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.22.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.22.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.21.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.20.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.20.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.20.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.20.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.19.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.19.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.19.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.19.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.