← Home

@ui5/webcomponents-react

npm Repository Homepage
51
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

sap-ospo-admin

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff obfuscated-file:ssr/components/AnalyticalCardHeader/AnalyticalCardHeader.module.css.js AI (source-diff): Minified CSS string in generated SSR module, not obfuscated code. ai
source-diff obfuscated-file:ssr/components/AnalyticalTable/AnalyticalTable.module.css.js AI (source-diff): Minified CSS string in generated SSR module, not obfuscated code. ai
source-diff large-new-source-files AI (source-diff): Expected from new build:ssr output directory added this version. ai
semgrep semgrep:api-obfuscation-reflect AI (semgrep): Reflect.get used for dynamic CSS class name lookup by message type — not obfuscation, stable pattern for this package. ai
dependencies unvetted-dep:@ui5/webcomponents-react-base AI (dependencies): Same @ui5/ namespace sibling package; co-published by the same org/CI pipeline. ai

Versions (showing 51 of 56)

View all versions
Version Deps Published
2.24.0 3 / 0
2.23.2 3 / 0
2.23.1 3 / 0
2.23.0 3 / 0
2.22.2 3 / 0
2.22.1 3 / 0
2.22.0 3 / 0
2.21.3 4 / 0
2.21.2 4 / 0
2.21.1 4 / 0
2.21.0 4 / 0
2.20.1 4 / 0
2.20.0 4 / 0
2.19.0 4 / 0
2.18.1 4 / 0
2.18.0 4 / 0
2.17.0 4 / 0
2.16.0 4 / 0
2.15.3 4 / 0
2.15.2 4 / 0
2.15.1 4 / 0
2.15.0 4 / 0
2.14.1 4 / 0
2.14.0 4 / 0
2.13.2 4 / 0
2.13.1 4 / 0
2.13.0 4 / 0
2.12.0 4 / 0
2.11.1 4 / 0
2.11.0 4 / 0
2.10.1 4 / 0
2.10.0 4 / 0
2.9.2 4 / 0
2.9.1 4 / 0
2.9.0 4 / 0
2.8.2 4 / 0
2.8.1 4 / 0
2.8.0 4 / 0
2.7.3 4 / 0
2.7.2 4 / 0
2.7.1 4 / 0
2.7.0 4 / 0
2.6.0 4 / 0
2.5.0 4 / 0
2.4.0 5 / 0
2.3.3 5 / 0
2.3.2 5 / 0
2.3.1 5 / 0
2.3.0 5 / 0
2.2.0 5 / 0
2.1.1 5 / 0

v2.24.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.23.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.23.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.16.0

2 findings
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

INFO Publisher changed: marcusnotheis → GitHub Actions (on 2025-11-07, now via trusted publisher with provenance) provenance

This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (marcusnotheis) on 2025-11-07, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.

v2.10.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.9.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.9.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.9.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.8.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.8.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.8.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.7.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.7.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.7.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.7.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.6.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.5.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.4.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.3.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.3.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.3.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.3.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.2.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.1.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.