@wordpress/block-library
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| npm-metadata | url-dep:@wordpress/integration-tests | AI (npm-metadata): Monorepo devDependency file: ref, standard for @wordpress packages. | ai | |
| phantom-deps | phantom-dep:@wordpress/viewport | AI (phantom-deps): Same-org sibling dep, common monorepo pattern. | ai | |
| phantom-deps | phantom-dep:@wordpress/reusable-blocks | AI (phantom-deps): Same-org sibling dep, common monorepo pattern. | ai | |
| npm-metadata | url-dep:@wordpress/stylelint-tools | AI (npm-metadata): Monorepo devDependency file: ref, standard for @wordpress packages. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): New dep is official @wordpress/* sibling package from same monorepo release. | ai | |
| phantom-deps | phantom-dep:@wordpress/base-styles | AI (phantom-deps): Same org scope; base-styles is a CSS/SCSS dependency not directly imported in JS — stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:escape-html | AI (phantom-deps): escape-html is a declared runtime dep in package.json; phantom-dep heuristic false positive for this package. | ai |
Versions (showing 30 of 30)
| Version | Deps | Published |
|---|---|---|
| 10.2.0 | 49 / 7 | |
| 10.1.0 | 48 / 5 | |
| 10.0.1 | 48 / 5 | |
| 10.0.0 | 48 / 5 | |
| 9.48.1 | 49 / 5 | |
| 9.48.0 | 48 / 1 | |
| 9.47.0 | 48 / 1 | |
| 9.46.0 | 48 / 1 | |
| 9.45.0 | 47 / 1 | |
| 9.44.0 | 46 / 1 | |
| 9.43.0 | 46 / 1 | |
| 9.42.0 | 46 / 1 | |
| 9.41.0 | 46 / 1 | |
| 9.40.2 | 45 / 1 | |
| 9.40.1 | 45 / 1 | |
| 9.40.0 | 45 / 1 | |
| 9.39.0 | 44 / 1 | |
| 9.38.0 | 44 / 1 | |
| 9.37.0 | 44 / 0 | |
| 9.36.0 | 44 / 0 | |
| 9.35.0 | 44 / 0 | |
| 9.33.10 | 44 / 0 | |
| 9.33.9 | 44 / 0 | |
| 9.33.8 | 44 / 0 | |
| 9.33.7 | 44 / 0 | |
| 9.33.6 | 44 / 0 | |
| 9.33.5 | 44 / 0 | |
| 9.33.4 | 44 / 0 | |
| 9.33.3 | 44 / 0 | |
| 9.19.6 | 43 / 0 |
v10.2.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (desrosj) than the most recent previously approved version (gutenbergplugin) on 2026-07-14, but desrosj is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v10.1.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v10.0.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v10.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.44.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (gutenbergplugin) than the most recent previously approved version (mamaduka) on 2026-04-15, but gutenbergplugin is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v9.43.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (gutenbergplugin) than the most recent previously approved version (mamaduka) on 2026-04-01, but gutenbergplugin is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v9.42.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.41.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.40.2
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (desrosj) than the most recent previously approved version (gutenbergplugin) on 2026-06-30, but desrosj is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v9.40.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.40.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.39.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.38.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.37.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.36.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.35.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.33.10
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (peterwilsoncc) than the most recent previously approved version (gutenbergplugin) on 2026-01-29, but peterwilsoncc is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v9.33.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.33.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.33.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.33.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.33.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.33.4
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (gutenbergplugin) than the most recent previously approved version (mamaduka) on 2025-11-04, but gutenbergplugin is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v9.33.3
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (gutenbergplugin) than the most recent previously approved version (mamaduka) on 2025-11-03, but gutenbergplugin is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.