@prairielearn/ui
UI components, utilities, and styles shared between PrairieLearn and PrairieTest.
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@prairielearn/preact-cjs | AI (dependencies): First-party PrairieLearn org package, expected internal dependency. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): nuqs and use-debounce are established, widely-used React utility packages. | ai | |
| provenance | missing-githead | AI (provenance): CI-published monorepo package; no gitHead is common, no behavior change vs approved sibling. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Monorepo CI publisher, no new suspicious maintainer added, diff otherwise clean. | ai | |
| typosquat | typosquat.levenshtein:yup | AI (typosquat): Scoped @prairielearn package; Levenshtein match against short names is a false positive for this namespace. | ai | |
| typosquat | typosquat.levenshtein:uuid | AI (typosquat): Scoped @prairielearn package; Levenshtein match against short names is a false positive for this namespace. | ai | |
| phantom-deps | phantom-dep:@types/react-dom | AI (phantom-deps): Type-only peer dep; convention-loaded, not directly imported. | ai | |
| phantom-deps | phantom-dep:@types/react | AI (phantom-deps): Type-only peer dep; convention-loaded, not directly imported. | ai | |
| typosquat | typosquat.levenshtein:pg | AI (typosquat): Scoped @prairielearn package; Levenshtein match against short names is a false positive for this namespace. | ai | |
| typosquat | typosquat.levenshtein:qs | AI (typosquat): Scoped @prairielearn package; Levenshtein match against short names is a false positive for this namespace. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): Scoped @prairielearn package; Levenshtein match against short names is a false positive for this namespace. | ai |
Versions (showing 22 of 22)
| Version | Deps | Published |
|---|---|---|
| 3.7.0 | 16 / 5 | |
| 3.6.0 | 16 / 5 | |
| 3.5.2 | 16 / 5 | |
| 3.5.1 | 16 / 5 | |
| 3.5.0 | 16 / 5 | |
| 3.4.1 | 15 / 5 | |
| 3.4.0 | 15 / 5 | |
| 3.3.0 | 15 / 6 | |
| 3.2.2 | 15 / 6 | |
| 3.2.1 | 15 / 6 | |
| 3.2.0 | 15 / 6 | |
| 3.1.5 | 15 / 6 | |
| 3.1.4 | 15 / 6 | |
| 3.1.3 | 15 / 6 | |
| 3.1.2 | 14 / 6 | |
| 3.1.1 | 14 / 6 | |
| 3.1.0 | 14 / 6 | |
| 3.0.0 | 12 / 6 | |
| 2.0.0 | 12 / 6 | |
| 1.7.0 | 9 / 5 | |
| 1.3.0 | 7 / 5 | |
| 1.2.0 | 7 / 5 |
v3.7.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.7.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.2.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.