@times-components/article-comments
Article Comments
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | no-provenance | AI (provenance): Established newsuk monorepo package; no provenance attestation is consistent across all versions. | ai | |
| phantom-deps | phantom-dep:@times-components/user-state | AI (phantom-deps): Same-org sibling dep in a monorepo; phantom-dep heuristic is unreliable for monorepo packages. | ai |
Versions (showing 100 of 328)
| Version | Deps | Published |
|---|---|---|
| 0.57.95 | 8 / 16 | |
| 0.57.94 | 8 / 16 | |
| 0.57.93 | 8 / 16 | |
| 0.57.92 | 8 / 16 | |
| 0.57.91 | 8 / 16 | |
| 0.57.90 | 8 / 16 | |
| 0.57.89 | 8 / 16 | |
| 0.57.88 | 8 / 16 | |
| 0.57.87 | 8 / 16 | |
| 0.57.86 | 8 / 16 | |
| 0.57.85 | 8 / 16 | |
| 0.57.84 | 8 / 16 | |
| 0.57.83 | 8 / 16 | |
| 0.57.82 | 8 / 16 | |
| 0.57.81 | 8 / 16 | |
| 0.57.80 | 8 / 16 | |
| 0.57.79 | 8 / 16 | |
| 0.57.78 | 8 / 16 | |
| 0.57.77 | 8 / 16 | |
| 0.57.75 | 8 / 16 | |
| 0.57.74 | 8 / 16 | |
| 0.57.73 | 8 / 16 | |
| 0.57.72 | 8 / 16 | |
| 0.57.71 | 8 / 16 | |
| 0.57.62 | 8 / 16 | |
| 0.57.61 | 8 / 16 | |
| 0.57.33 | 8 / 16 | |
| 0.57.19 | 8 / 16 | |
| 0.57.12 | 8 / 16 | |
| 0.57.11 | 8 / 16 | |
| 0.57.10 | 8 / 16 | |
| 0.57.9 | 8 / 16 | |
| 0.57.8 | 8 / 16 | |
| 0.57.7 | 8 / 16 | |
| 0.57.6 | 8 / 16 | |
| 0.57.5 | 8 / 16 | |
| 0.57.4 | 8 / 16 | |
| 0.57.3 | 8 / 16 | |
| 0.57.2 | 8 / 16 | |
| 0.57.1 | 8 / 16 | |
| 0.57.0 | 8 / 16 | |
| 0.56.0 | 8 / 16 | |
| 0.55.3 | 8 / 16 | |
| 0.55.2 | 8 / 16 | |
| 0.55.1 | 8 / 16 | |
| 0.55.0 | 8 / 16 | |
| 0.54.0 | 8 / 16 | |
| 0.53.0 | 8 / 16 | |
| 0.52.1 | 8 / 16 | |
| 0.52.0 | 8 / 16 | |
| 0.51.1 | 8 / 16 | |
| 0.51.0 | 8 / 16 | |
| 0.50.5 | 8 / 16 | |
| 0.50.4 | 8 / 16 | |
| 0.50.3 | 8 / 16 | |
| 0.50.2 | 8 / 16 | |
| 0.50.1 | 8 / 16 | |
| 0.50.0 | 8 / 16 | |
| 0.49.3 | 8 / 16 | |
| 0.49.2 | 8 / 16 | |
| 0.49.1 | 8 / 16 | |
| 0.49.0 | 8 / 16 | |
| 0.48.5 | 8 / 16 | |
| 0.48.4 | 8 / 16 | |
| 0.48.3 | 8 / 16 | |
| 0.48.1 | 8 / 16 | |
| 0.48.0 | 8 / 16 | |
| 0.47.2 | 8 / 16 | |
| 0.47.1 | 8 / 16 | |
| 0.47.0 | 8 / 16 | |
| 0.46.2 | 8 / 16 | |
| 0.46.1 | 8 / 16 | |
| 0.46.0 | 8 / 16 | |
| 0.45.2 | 8 / 16 | |
| 0.45.1 | 8 / 16 | |
| 0.45.0 | 8 / 16 | |
| 0.44.44 | 7 / 16 | |
| 0.44.43 | 7 / 16 | |
| 0.44.42 | 7 / 16 | |
| 0.44.41 | 7 / 16 | |
| 0.44.40 | 7 / 16 | |
| 0.44.39 | 7 / 16 | |
| 0.44.38 | 7 / 16 | |
| 0.44.37 | 7 / 16 | |
| 0.44.36 | 7 / 16 | |
| 0.44.35 | 7 / 16 | |
| 0.44.34 | 7 / 16 | |
| 0.44.33 | 7 / 16 | |
| 0.44.32 | 7 / 16 | |
| 0.44.31 | 7 / 16 | |
| 0.44.30 | 7 / 16 | |
| 0.44.29 | 7 / 16 | |
| 0.44.28 | 7 / 16 | |
| 0.44.27 | 7 / 16 | |
| 0.44.26 | 7 / 16 | |
| 0.44.25 | 7 / 16 | |
| 0.44.24 | 7 / 16 | |
| 0.44.23 | 7 / 16 | |
| 0.44.22 | 7 / 16 | |
| 0.44.21 | 7 / 16 |
v0.57.95
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.57.94
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.57.93
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.57.92
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.57.91
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.49.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.49.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.49.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.49.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.48.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.48.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.48.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.48.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.48.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.47.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.47.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.47.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.46.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.46.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.46.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.45.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.45.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.45.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.44
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.43
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.42
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.41
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.40
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.39
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.38
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.37
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.36
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.35
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.34
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.33
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.32
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.31
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.30
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.29
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.28
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.27
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.26
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.25
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.24
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.23
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.22
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.21
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.