@univerjs/design
UI component library for building exceptional Univer.
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:rc-select | AI (phantom-deps): Bundled lib output; rc-select is a normal UI dep for this design system. | ai | |
| phantom-deps | phantom-dep:rc-input | AI (phantom-deps): Bundled lib output; rc-input is a normal UI dep for this design system. | ai | |
| phantom-deps | phantom-dep:@rc-component/color-picker | AI (phantom-deps): Common UI lib, used indirectly by config; stable false positive. | ai | |
| phantom-deps | phantom-dep:@types/react-mentions | AI (phantom-deps): Type-only package, framework convention. | ai | |
| phantom-deps | phantom-dep:react-draggable | AI (phantom-deps): Common UI lib, used indirectly by config; stable false positive. | ai | |
| phantom-deps | phantom-dep:rc-dialog | AI (phantom-deps): Common UI lib, used indirectly by config; stable false positive. | ai | |
| dependencies | unvetted-dep:@types/react-mentions | AI (dependencies): Type-only dependency, no runtime risk. | ai | |
| phantom-deps | phantom-dep:rc-input-number | AI (phantom-deps): Common UI lib, used indirectly by config; stable false positive. | ai | |
| phantom-deps | phantom-dep:rc-util | AI (phantom-deps): Common UI lib, used indirectly by config; stable false positive. | ai | |
| source-diff | obfuscated-file:lib/cjs/locale/es-ES.js | AI (source-diff): Minified dayjs locale bundle; standard build output. | ai | |
| source-diff | obfuscated-file:lib/umd/locale/es-ES.js | AI (source-diff): UMD variant of same minified locale bundle. | ai | |
| source-diff | obfuscated-file:lib/cjs/locale/ca-ES.js | AI (source-diff): Minified dayjs locale bundle; standard build output for this UI library. | ai | |
| source-diff | obfuscated-file:lib/umd/locale/ca-ES.js | AI (source-diff): UMD variant of same minified locale bundle. | ai | |
| source-diff | obfuscated-file:lib/umd/locale/ko-KR.js | AI (source-diff): UMD variant of the same minified dayjs locale bundle. | ai | |
| source-diff | obfuscated-file:lib/cjs/locale/ko-KR.js | AI (source-diff): Minified dayjs ko-KR locale bundle; standard build output for this package. | ai | |
| dependencies | unvetted-dep:@radix-ui/react-hover-card | AI (dependencies): @radix-ui/react-hover-card is a well-known, widely-used Radix UI component; stable false positive for this package. | ai | |
| dependencies | unvetted-dep:@univerjs/icons | AI (dependencies): Same org scope (@univerjs); stable dependency across this package's many versions. | ai | |
| phantom-deps | phantom-dep:rc-virtual-list | AI (phantom-deps): Declared runtime dep; phantom-dep heuristic false positive for this package. | ai | |
| phantom-deps | phantom-dep:dayjs | AI (phantom-deps): dayjs is a declared runtime dep; phantom-dep heuristic fires on config-file references, not a real concern. | ai | |
| phantom-deps | phantom-dep:tailwind-merge | AI (phantom-deps): Used in config/build context for this UI library; stable false positive. | ai | |
| phantom-deps | phantom-dep:react-transition-group | AI (phantom-deps): Referenced in config files; stable false positive for this UI component library. | ai | |
| phantom-deps | phantom-dep:@radix-ui/react-slot | AI (phantom-deps): Referenced in config files; stable false positive for this UI component library. | ai | |
| phantom-deps | phantom-dep:@univerjs/icons | AI (phantom-deps): Same org scope; likely re-exported or used indirectly; stable false positive. | ai |
Versions (showing 8 of 108)
| Version | Deps | Published |
|---|---|---|
| 0.1.8 | 17 / 14 | |
| 0.1.7 | 18 / 13 | |
| 0.1.6 | 17 / 12 | |
| 0.1.5 | 16 / 12 | |
| 0.1.4 | 16 / 12 | |
| 0.1.3 | 15 / 12 | |
| 0.1.2 | 13 / 13 | |
| 0.1.1 | 13 / 13 |
v0.1.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.