@red-hat-developer-hub/backstage-plugin-global-header
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): rhdh-bot is Red Hat's CI automation account; publisher transitions to this bot are expected for this package family. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): rhdh-bot and schultzp2020 are Red Hat org members; addition consistent with team maintenance practices. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Backstage plugin with minimal README; not indicative of spam or malice for this established package. | ai | |
| dependencies | unvetted-dep:@scalprum/react-core | AI (dependencies): @scalprum/react-core is a Red Hat OpenShift console library; its use is expected in RHDH plugins. | ai | |
| phantom-deps | phantom-dep:@backstage/plugin-search-common | AI (phantom-deps): Backstage plugin declares deps in config files; phantom-dep false positive for this package. | ai | |
| phantom-deps | phantom-dep:@backstage/plugin-search-backend | AI (phantom-deps): Backstage plugin declares deps in config files; phantom-dep false positive for this package. | ai | |
| phantom-deps | phantom-dep:@backstage/plugin-notifications-common | AI (phantom-deps): Backstage plugin declares deps in config files; phantom-dep false positive for this package. | ai | |
| phantom-deps | phantom-dep:react-use | AI (phantom-deps): Backstage plugin declares deps in config files; phantom-dep false positive for this package. | ai | |
| phantom-deps | phantom-dep:@backstage/plugin-search-backend-module-catalog | AI (phantom-deps): Backstage plugin declares deps in config files; phantom-dep false positive for this package. | ai | |
| phantom-deps | phantom-dep:@backstage/plugin-search-backend-module-techdocs | AI (phantom-deps): Backstage plugin declares deps in config files; phantom-dep false positive for this package. | ai | |
| phantom-deps | phantom-dep:@backstage/plugin-search-backend-module-pg | AI (phantom-deps): Backstage plugin declares deps in config files; phantom-dep false positive for this package. | ai | |
| phantom-deps | phantom-dep:@backstage/theme | AI (phantom-deps): Backstage plugin declares deps in config files; phantom-dep false positive for this package. | ai | |
| phantom-deps | phantom-dep:@mui/styled-engine | AI (phantom-deps): Backstage plugin declares deps in config files; phantom-dep false positive for this package. | ai | |
| phantom-deps | phantom-dep:@backstage/plugin-search | AI (phantom-deps): Backstage plugin declares deps in config files; phantom-dep false positive for this package. | ai |
Versions (showing 50 of 50)
| Version | Deps | Published |
|---|---|---|
| 1.22.1 | 23 / 16 | |
| 1.22.0 | 24 / 16 | |
| 1.21.7 | 24 / 16 | |
| 1.21.6 | 24 / 16 | |
| 1.21.5 | 23 / 16 | |
| 1.21.4 | 23 / 16 | |
| 1.21.3 | 23 / 16 | |
| 1.21.2 | 23 / 16 | |
| 1.21.1 | 23 / 16 | |
| 1.21.0 | 23 / 16 | |
| 1.20.3 | 21 / 16 | |
| 1.20.2 | 21 / 16 | |
| 1.20.1 | 21 / 15 | |
| 1.20.0 | 21 / 15 | |
| 1.19.0 | 21 / 15 | |
| 1.18.2 | 21 / 15 | |
| 1.18.1 | 21 / 15 | |
| 1.18.0 | 21 / 15 | |
| 1.17.3 | 21 / 15 | |
| 1.17.2 | 21 / 15 | |
| 1.17.1 | 21 / 15 | |
| 1.17.0 | 21 / 15 | |
| 1.16.1 | 21 / 15 | |
| 1.16.0 | 21 / 15 | |
| 1.15.1 | 21 / 15 | |
| 1.15.0 | 21 / 15 | |
| 1.14.1 | 21 / 15 | |
| 1.14.0 | 21 / 15 | |
| 1.13.0 | 21 / 15 | |
| 1.12.0 | 21 / 15 | |
| 1.11.2 | 21 / 15 | |
| 1.11.1 | 21 / 15 | |
| 1.11.0 | 21 / 15 | |
| 1.10.1 | 21 / 15 | |
| 1.9.0 | 21 / 15 | |
| 1.8.0 | 21 / 15 | |
| 1.7.3 | 21 / 14 | |
| 1.7.2 | 21 / 14 | |
| 1.7.1 | 21 / 14 | |
| 1.7.0 | 21 / 14 | |
| 1.6.0 | 21 / 14 | |
| 1.5.2 | 21 / 14 | |
| 1.5.1 | 21 / 14 | |
| 1.5.0 | 20 / 14 | |
| 1.4.0 | 20 / 14 | |
| 1.3.0 | 20 / 14 | |
| 1.2.0 | 20 / 14 | |
| 1.1.0 | 20 / 14 | |
| 1.0.1 | 21 / 14 | |
| 1.0.0 | 20 / 14 |
v1.22.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.22.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.21.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.5.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.2.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.