@ui5/webcomponents-react
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:ssr/components/AnalyticalCardHeader/AnalyticalCardHeader.module.css.js | AI (source-diff): Minified CSS string in generated SSR module, not obfuscated code. | ai | |
| source-diff | obfuscated-file:ssr/components/AnalyticalTable/AnalyticalTable.module.css.js | AI (source-diff): Minified CSS string in generated SSR module, not obfuscated code. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Expected from new build:ssr output directory added this version. | ai | |
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Reflect.get used for dynamic CSS class name lookup by message type — not obfuscation, stable pattern for this package. | ai | |
| dependencies | unvetted-dep:@ui5/webcomponents-react-base | AI (dependencies): Same @ui5/ namespace sibling package; co-published by the same org/CI pipeline. | ai |
Versions (showing 56 of 56)
| Version | Deps | Published |
|---|---|---|
| 2.24.0 | 3 / 0 | |
| 2.23.2 | 3 / 0 | |
| 2.23.1 | 3 / 0 | |
| 2.23.0 | 3 / 0 | |
| 2.22.2 | 3 / 0 | |
| 2.22.1 | 3 / 0 | |
| 2.22.0 | 3 / 0 | |
| 2.21.3 | 4 / 0 | |
| 2.21.2 | 4 / 0 | |
| 2.21.1 | 4 / 0 | |
| 2.21.0 | 4 / 0 | |
| 2.20.1 | 4 / 0 | |
| 2.20.0 | 4 / 0 | |
| 2.19.0 | 4 / 0 | |
| 2.18.1 | 4 / 0 | |
| 2.18.0 | 4 / 0 | |
| 2.17.0 | 4 / 0 | |
| 2.16.0 | 4 / 0 | |
| 2.15.3 | 4 / 0 | |
| 2.15.2 | 4 / 0 | |
| 2.15.1 | 4 / 0 | |
| 2.15.0 | 4 / 0 | |
| 2.14.1 | 4 / 0 | |
| 2.14.0 | 4 / 0 | |
| 2.13.2 | 4 / 0 | |
| 2.13.1 | 4 / 0 | |
| 2.13.0 | 4 / 0 | |
| 2.12.0 | 4 / 0 | |
| 2.11.1 | 4 / 0 | |
| 2.11.0 | 4 / 0 | |
| 2.10.1 | 4 / 0 | |
| 2.10.0 | 4 / 0 | |
| 2.9.2 | 4 / 0 | |
| 2.9.1 | 4 / 0 | |
| 2.9.0 | 4 / 0 | |
| 2.8.2 | 4 / 0 | |
| 2.8.1 | 4 / 0 | |
| 2.8.0 | 4 / 0 | |
| 2.7.3 | 4 / 0 | |
| 2.7.2 | 4 / 0 | |
| 2.7.1 | 4 / 0 | |
| 2.7.0 | 4 / 0 | |
| 2.6.0 | 4 / 0 | |
| 2.5.0 | 4 / 0 | |
| 2.4.0 | 5 / 0 | |
| 2.3.3 | 5 / 0 | |
| 2.3.2 | 5 / 0 | |
| 2.3.1 | 5 / 0 | |
| 2.3.0 | 5 / 0 | |
| 2.2.0 | 5 / 0 | |
| 2.1.1 | 5 / 0 | |
| 2.1.0 | 5 / 0 | |
| 2.0.2 | 4 / 0 | |
| 2.0.1 | 4 / 0 | |
| 2.0.0 | 4 / 0 | |
| 1.29.24 | 5 / 0 |
v2.24.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.23.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.23.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.16.0
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (marcusnotheis) on 2025-11-07, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.
v2.10.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.9.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.9.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.9.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.8.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.8.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.8.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.7.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.7.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.7.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.7.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.6.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.5.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.4.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.3.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.3.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.3.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.3.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.2.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.1.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.1.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.0.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.0.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.0.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.29.24
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.