@red-hat-developer-hub/backstage-plugin-orchestrator-form-widgets
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@red-hat-developer-hub/backstage-plugin-orchestrator-common | AI (dependencies): Same-org sibling package from redhat-developer/rhdh-plugins; not a third-party risk. | ai | |
| dependencies | unvetted-dep:@red-hat-developer-hub/backstage-plugin-orchestrator-form-api | AI (dependencies): Same-org sibling package from redhat-developer/rhdh-plugins; not a third-party risk. | ai | |
| dependencies | unvetted-dep:@red-hat-developer-hub/backstage-plugin-orchestrator-form-react | AI (dependencies): Same-org sibling package from redhat-developer/rhdh-plugins; not a third-party risk. | ai | |
| phantom-deps | phantom-dep:@mui/styles | AI (phantom-deps): Referenced in config/type files; stable false positive for this Backstage plugin. | ai | |
| phantom-deps | phantom-dep:json-schema | AI (phantom-deps): Referenced in config files; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@backstage/theme | AI (phantom-deps): Common Backstage peer/config dep; stable false positive. | ai | |
| phantom-deps | phantom-dep:@backstage/types | AI (phantom-deps): Common Backstage peer/config dep; stable false positive. | ai | |
| phantom-deps | phantom-dep:@rjsf/material-ui | AI (phantom-deps): RJSF widget dep referenced in config; stable false positive. | ai | |
| phantom-deps | phantom-dep:@mui/icons-material | AI (phantom-deps): MUI dep referenced in config; stable false positive. | ai | |
| phantom-deps | phantom-dep:@red-hat-developer-hub/backstage-plugin-orchestrator-form-react | AI (phantom-deps): Same-org sibling; phantom-dep is a stable false positive here. | ai |
Versions (showing 46 of 46)
| Version | Deps | Published |
|---|---|---|
| 1.12.0 | 19 / 13 | |
| 1.11.3 | 19 / 13 | |
| 1.11.2 | 19 / 13 | |
| 1.11.1 | 19 / 13 | |
| 1.11.0 | 19 / 13 | |
| 1.10.8 | 19 / 13 | |
| 1.10.7 | 19 / 13 | |
| 1.10.6 | 19 / 13 | |
| 1.10.5 | 19 / 13 | |
| 1.10.4 | 19 / 13 | |
| 1.10.3 | 19 / 13 | |
| 1.10.2 | 19 / 13 | |
| 1.10.1 | 19 / 13 | |
| 1.10.0 | 19 / 13 | |
| 1.9.0 | 18 / 13 | |
| 1.8.0 | 18 / 13 | |
| 1.7.3 | 17 / 13 | |
| 1.7.2 | 17 / 13 | |
| 1.7.1 | 17 / 13 | |
| 1.7.0 | 17 / 13 | |
| 1.6.10 | 17 / 13 | |
| 1.6.9 | 17 / 13 | |
| 1.6.8 | 17 / 13 | |
| 1.6.7 | 17 / 13 | |
| 1.6.6 | 17 / 13 | |
| 1.6.5 | 17 / 13 | |
| 1.6.4 | 17 / 13 | |
| 1.6.3 | 17 / 13 | |
| 1.6.2 | 17 / 13 | |
| 1.6.1 | 17 / 13 | |
| 1.6.0 | 17 / 13 | |
| 1.5.0 | 17 / 11 | |
| 1.4.1 | 17 / 11 | |
| 1.4.0 | 17 / 11 | |
| 1.3.0 | 17 / 11 | |
| 1.2.0 | 17 / 11 | |
| 1.1.0 | 17 / 11 | |
| 1.0.8 | 17 / 11 | |
| 1.0.7 | 17 / 11 | |
| 1.0.6 | 17 / 11 | |
| 1.0.5 | 17 / 11 | |
| 1.0.4 | 17 / 11 | |
| 1.0.3 | 17 / 11 | |
| 1.0.2 | 16 / 11 | |
| 1.0.1 | 16 / 11 | |
| 1.0.0 | 16 / 11 |
v1.12.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.