@radix-ui/react-use-rect
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | missing-githead | AI (provenance): SLSA-attested CI publish; gitHead absence is a build-env change, not a risk for this package. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): Known Radix UI team restructuring; chancestrickland and mark-workos are WorkOS maintainers. | ai | |
| provenance | publisher-changed | AI (provenance): Legitimate Radix UI org transition to chancestrickland (WorkOS); stable for this package. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Previous maintainers replaced as part of known Radix UI org transition. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Radix UI primitives publish in batches; dormancy reflects release cadence, not takeover. | ai | |
| dependencies | unvetted-dep:@radix-ui/rect | AI (dependencies): @radix-ui/rect is a sibling package from the same radix-ui/primitives monorepo; dependency is expected and benign. | ai | |
| provenance | no-provenance | AI (provenance): Established Radix UI package with 50M+ weekly downloads; lack of provenance is a known gap for this publisher, not a security risk. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Radix UI scoped packages routinely omit descriptions; this is a stable pattern across the monorepo, not a malice indicator. | ai |
Versions (showing 7 of 7)
| Version | Deps | Published |
|---|---|---|
| 1.1.4 | 1 / 7 | |
| 1.1.3 | 1 / 7 | |
| 1.1.2 | 1 / 7 | |
| 1.1.1 | 1 / 8 | |
| 1.1.0 | 1 / 0 | |
| 1.0.1 | 2 / 0 | |
| 1.0.0 | 2 / 0 |
v1.1.4
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
v1.1.3
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.