@openui5/sap.uxap
OpenUI5 UI Library sap.uxap
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:@openui5/sap.f | AI (phantom-deps): Same-org UI5 framework dep; declared for peer resolution, not direct import. Stable pattern. | ai | |
| phantom-deps | phantom-dep:@openui5/sap.m | AI (phantom-deps): Same-org UI5 framework dep; declared for peer resolution, not direct import. Stable pattern. | ai | |
| phantom-deps | phantom-dep:@openui5/sap.ui.core | AI (phantom-deps): Same-org UI5 framework dep; declared for peer resolution, not direct import. Stable pattern. | ai | |
| phantom-deps | phantom-dep:@openui5/sap.ui.layout | AI (phantom-deps): Same-org UI5 framework dep; declared for peer resolution, not direct import. Stable pattern. | ai | |
| provenance | no-provenance | AI (provenance): SAP OpenUI5 bot publisher; no provenance is consistent across all 699 versions of this package. | ai |
Versions (showing 51 of 98)
| Version | Deps | Published |
|---|---|---|
| 1.148.0 | 4 / 0 | |
| 1.147.1 | 4 / 0 | |
| 1.147.0 | 4 / 0 | |
| 1.146.0 | 4 / 0 | |
| 1.145.3 | 4 / 0 | |
| 1.145.2 | 4 / 0 | |
| 1.145.1 | 4 / 0 | |
| 1.145.0 | 4 / 0 | |
| 1.144.0 | 4 / 0 | |
| 1.143.1 | 4 / 0 | |
| 1.143.0 | 4 / 0 | |
| 1.142.9 | 4 / 0 | |
| 1.142.8 | 4 / 0 | |
| 1.142.7 | 4 / 0 | |
| 1.142.6 | 4 / 0 | |
| 1.142.5 | 4 / 0 | |
| 1.142.4 | 4 / 0 | |
| 1.142.3 | 4 / 0 | |
| 1.142.2 | 4 / 0 | |
| 1.142.1 | 4 / 0 | |
| 1.142.0 | 4 / 0 | |
| 1.141.2 | 4 / 0 | |
| 1.141.1 | 4 / 0 | |
| 1.141.0 | 4 / 0 | |
| 1.140.0 | 4 / 0 | |
| 1.139.3 | 4 / 0 | |
| 1.139.2 | 4 / 0 | |
| 1.139.1 | 4 / 0 | |
| 1.139.0 | 4 / 0 | |
| 1.138.0 | 4 / 0 | |
| 1.136.17 | 4 / 0 | |
| 1.136.16 | 4 / 0 | |
| 1.136.15 | 4 / 0 | |
| 1.136.14 | 4 / 0 | |
| 1.136.13 | 4 / 0 | |
| 1.136.12 | 4 / 0 | |
| 1.136.11 | 4 / 0 | |
| 1.136.10 | 4 / 0 | |
| 1.136.9 | 4 / 0 | |
| 1.136.8 | 4 / 0 | |
| 1.136.7 | 4 / 0 | |
| 1.136.6 | 4 / 0 | |
| 1.136.5 | 4 / 0 | |
| 1.136.4 | 4 / 0 | |
| 1.136.3 | 4 / 0 | |
| 1.136.2 | 4 / 0 | |
| 1.136.1 | 4 / 0 | |
| 1.136.0 | 4 / 0 | |
| 1.133.3 | 4 / 0 | |
| 1.130.8 | 4 / 0 | |
| 1.120.45 | 4 / 0 |
v1.148.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.147.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.146.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.145.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.145.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.145.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.145.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.144.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.143.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.143.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.142.9
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.142.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.142.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.142.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.142.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.142.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.142.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.142.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.142.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.142.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.141.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.141.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.141.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.140.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.139.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.139.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.139.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.139.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.138.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.136.17
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.136.16
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.136.15
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.136.14
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.136.13
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.136.12
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.136.11
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.136.10
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.136.9
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.136.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.136.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.136.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.136.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.136.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.136.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.136.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.136.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.136.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.133.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.130.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.120.45
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.