@radix-ui/react-dialog — Greenflagged

View docs [here](https://radix-ui.com/primitives/docs/components/dialog).

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

hadihallakchancestricklandmark-workosnpm-workos

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
provenance	missing-githead	AI (provenance): Benign publish-env change on a canonical high-trust package; no malicious behavior.	ai	2026/07/08
provenance	publisher-changed	AI (provenance): Legitimate maintainer transition to WorkOS team (chancestrickland); stable for this org.	ai	2026/05/29
maintainer-change	maintainer-added	AI (maintainer-change): Known WorkOS team members added as part of org transition.	ai	2026/05/29
maintainer-change	maintainer-removed	AI (maintainer-change): Previous maintainers removed as part of known org transition.	ai	2026/05/29
publish-pattern	dormant-publish	AI (publish-pattern): Dormancy reflects org restructuring; radix-ui is actively maintained.	ai	2026/05/29
bogus-package	bogus-package	AI (bogus-package): Radix UI primitives are well-known; sparse README is a monorepo artifact.	ai	2026/05/29

Versions (showing 30 of 30)

Version	Deps	Published
1.1.23	15 / 7	2026/07/24
1.1.22	15 / 7	2026/07/24
1.1.21	15 / 7	2026-07-22
1.1.20	15 / 7	2026-07-20
1.1.19	14 / 7	2026-07-06
1.1.18	14 / 7	2026-06-30
1.1.17	14 / 7	2026-06-15
1.1.16	14 / 7	2026-06-06
1.1.15	14 / 9	2025-08-13
1.1.14	14 / 9	2025-05-20
1.1.13	14 / 9	2025-05-06
1.1.12	14 / 9	2025-05-05
1.1.11	14 / 9	2025-04-22
1.1.10	14 / 9	2025-04-18
1.1.9	14 / 9	2025-04-18
1.1.8	14 / 9	2025-04-18
1.1.7	14 / 8	2025-04-08
1.1.6	14 / 8	2025-02-05
1.1.5	14 / 6	2025-01-22
1.1.4	14 / 0	2024-12-17
1.1.3	14 / 0	2024-12-13
1.1.2	14 / 0	2024-10-01
1.1.1	14 / 0	2024-06-21
1.1.0	14 / 0	2024-06-19
1.0.5	15 / 0	2023-09-25
1.0.4	15 / 0	2023-05-26
1.0.3	15 / 0	2023-03-08
1.0.2	15 / 0	2022-10-17
1.0.1	15 / 0	2022-10-17
1.0.0	15 / 0	2022-07-20

v1.1.23

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.1.22

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.1.21

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.1.20

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.1.19

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.1.18

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.1.14

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Missing gitHead — previous versions had it provenance

[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: chancestrickland.

v1.1.13

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.12

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Missing gitHead — previous versions had it provenance

[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: chancestrickland.

v1.1.11

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: chancestrickland.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.10

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: chancestrickland.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.9

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: chancestrickland.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.8

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: chancestrickland.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.2

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: vladmoroz → chancestrickland (on 2024-10-01) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2024-10-01. This could indicate a legitimate maintainer transition or an account compromise.

v1.1.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.0

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: benoitgrelard → vladmoroz (on 2024-06-19, known maintainer) provenance

This version was published by a different npm account (vladmoroz) than the most recent previously approved version (benoitgrelard) on 2024-06-19, but vladmoroz is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v1.0.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.