@salesforcedevs/dx-components
DX Lightning web components
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:microtip | AI (phantom-deps): CSS-only tooltip library; phantom-dep heuristic fires but it's a legitimate runtime dep for this UI component package. | ai | |
| phantom-deps | phantom-dep:salesforce-oauth2 | AI (phantom-deps): Referenced in config files; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@types/throttle-debounce | AI (phantom-deps): Type-only package loaded by convention; stable false positive. | ai | |
| phantom-deps | phantom-dep:@salesforcedevs/sfdocs-wires | AI (phantom-deps): Same org scope; framework-loaded dep, stable false positive. | ai |
Versions (showing 38 of 38)
| Version | Deps | Published |
|---|---|---|
| 1.37.1 | 19 / 12 | |
| 1.37.0 | 19 / 12 | |
| 1.36.3 | 19 / 12 | |
| 1.36.2 | 19 / 12 | |
| 1.36.1 | 19 / 12 | |
| 1.36.0 | 19 / 12 | |
| 1.35.2 | 19 / 12 | |
| 1.35.1 | 19 / 12 | |
| 1.35.0 | 19 / 12 | |
| 1.34.0 | 19 / 12 | |
| 1.33.1 | 19 / 12 | |
| 1.33.0 | 19 / 12 | |
| 1.32.0 | 19 / 12 | |
| 1.31.9 | 19 / 12 | |
| 1.31.6 | 19 / 12 | |
| 1.31.3 | 19 / 12 | |
| 1.31.2 | 19 / 12 | |
| 1.31.1 | 19 / 12 | |
| 1.31.0 | 19 / 12 | |
| 1.25.6 | 19 / 11 | |
| 1.22.0 | 19 / 11 | |
| 1.21.0 | 19 / 11 | |
| 1.20.16 | 19 / 11 | |
| 1.20.13 | 19 / 11 | |
| 1.20.12 | 19 / 11 | |
| 1.20.8 | 19 / 11 | |
| 1.20.7 | 19 / 11 | |
| 1.20.6 | 19 / 11 | |
| 1.20.5 | 19 / 11 | |
| 1.20.4 | 19 / 11 | |
| 1.20.3 | 19 / 11 | |
| 1.20.0 | 19 / 11 | |
| 1.19.6 | 19 / 11 | |
| 1.19.0 | 19 / 11 | |
| 1.18.11 | 19 / 11 | |
| 1.18.8 | 19 / 11 | |
| 1.18.3 | 18 / 11 | |
| 1.14.2 | 19 / 11 |
v1.37.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.37.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.36.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.36.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.36.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.36.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.35.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.35.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.35.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.