@spectrum-css/accordion
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Adobe org handoff; repo/author match official Spectrum CSS. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): Known maintainer rotation within Adobe org, confirmed by provenance INFO. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Normal maintainer turnover in large monorepo, not a takeover. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Diff baseline is a stale sibling version; monorepo has continuous npm activity. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Comparing against wrong baseline version; CSS component size growth is expected across major versions. | ai |
Versions (showing 6 of 6)
| Version | Deps | Published |
|---|---|---|
| 7.2.0 | 0 / 2 | |
| 7.1.1 | 0 / 2 | |
| 7.1.0 | 0 / 2 | |
| 7.0.1 | 0 / 6 | |
| 7.0.0 | 0 / 6 | |
| 3.0.24 | 0 / 4 |
v7.1.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.1.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (patrickfulton) than the most recent previously approved version (garthdb) on 2025-02-12, but patrickfulton is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v7.0.1
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (patrickfulton) than the most recent previously approved version (garthdb) on 2025-02-04, but patrickfulton is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v7.0.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (patrickfulton) than the most recent previously approved version (garthdb) on 2025-01-31, but patrickfulton is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.