@vaadin/grid — Greenflagged

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

web-padawandiegocardosoalvarezguilleplatoshajounimanoloyuriyyevvaadin-ownertomivirkkiartur-sunzhewyqsissbruecker

Keywords

vaadinelementscomponentswebcomponentsweb-componentsgriddatagriddatatabledata-griddata-table

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
publish-pattern	new-deps-added	AI (publish-pattern): All new deps (@polymer/polymer, @vaadin/vaadin-lumo-styles, @vaadin/vaadin-material-styles, @vaadin/a11y-base, lit) are established, legitimate packages in the Vaadin/Polymer/Lit ecosystem.	ai	2026/04/27
source-diff	large-new-source-files	AI (source-diff): Major version bump (23.x to 24.x) naturally introduces many new source files; no obfuscation or suspicious patterns flagged.	ai	2026/04/27
dependencies	unvetted-dep:@open-wc/dedupe-mixin	AI (dependencies): @open-wc/dedupe-mixin is a standard open-wc utility; legitimate and expected dependency for web component packages.	ai	2026/04/26
dependencies	unvetted-dep:@vaadin/checkbox	AI (dependencies): First-party @vaadin/* sibling package from the same monorepo release; expected dependency pattern.	ai	2026/04/26
dependencies	unvetted-dep:@vaadin/a11y-base	AI (dependencies): First-party @vaadin/* sibling package from the same monorepo release; expected dependency pattern.	ai	2026/04/26
typosquat	typosquat.levenshtein:uuid	AI (typosquat): @vaadin/grid is a scoped Vaadin data grid component with no meaningful similarity to 'uuid'; the levenshtein match is a false positive that generalizes across all versions.	ai	2026/04/26
dependencies	unvetted-dep:@vaadin/lit-renderer	AI (dependencies): First-party @vaadin/* sibling package from the same monorepo release; expected dependency pattern.	ai	2026/04/26
dependencies	unvetted-dep:@vaadin/component-base	AI (dependencies): First-party @vaadin/* sibling package from the same monorepo release; expected dependency pattern.	ai	2026/04/26
dependencies	unvetted-dep:@vaadin/vaadin-themable-mixin	AI (dependencies): First-party @vaadin/* sibling package from the same monorepo release; expected dependency pattern.	ai	2026/04/26
dependencies	unvetted-dep:@vaadin/text-field	AI (dependencies): First-party @vaadin/* sibling package from the same monorepo release; expected dependency pattern.	ai	2026/04/26
dependencies	unvetted-dep:lit	AI (dependencies): 'lit' is a well-known Google/Polymer web components library; a standard dependency for Vaadin components.	ai	2026/04/26