← Home

@rjsf/fluentui-rc

npm Repository Homepage

FluentUI React Components theme, fields and widgets for react-jsonschema-form

23
Versions
Apache-2.0
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

epicfaacerjsf-bot

Keywords

reactformjson-schemafluentuifluentui-rcrjsf-fluentui-rc

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
phantom-deps phantom-dep:@griffel/react AI (phantom-deps): @griffel/react is a legit Fluent UI styling dep, likely used via JSX/CSS transform not plain import. ai
provenance publisher-changed AI (provenance): rjsf monorepo migrated from rjsf-bot to GitHub Actions CI publishing; SLSA attestation confirms legitimate CI/CD origin. ai
publish-pattern dormant-publish AI (publish-pattern): Dormancy reflects monorepo release cadence, not account takeover; SLSA provenance and established repo confirm legitimacy. ai

Versions (showing 23 of 23)

Version Deps Published
6.7.1 1 / 8
6.7.0 1 / 8
6.6.2 0 / 7
6.6.1 0 / 7
6.6.0 0 / 7
6.5.3 0 / 8
6.5.2 0 / 8
6.5.1 0 / 8
6.5.0 0 / 8
6.4.2 0 / 8
6.4.1 0 / 8
6.4.0 0 / 8
6.3.1 0 / 8
6.3.0 0 / 8
6.2.5 0 / 8
6.2.4 0 / 8
6.2.3 0 / 8
6.1.2 0 / 8
6.1.1 0 / 8
6.1.0 0 / 8
6.0.2 0 / 8
6.0.1 0 / 8
6.0.0 0 / 8

v6.7.1

2 findings
HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.7.0

2 findings
HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.