react-dom — Greenflagged

React package for working with the DOM.

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

fbreact-bot

Keywords

react

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
provenance	publisher-changed	AI (provenance): Transition from react-bot to GitHub Actions CI/CD is a legitimate automation change for facebook/react.	ai	2026/06/02
publish-pattern	rapid-publish	AI (publish-pattern): React publishes multiple packages in rapid succession from CI; normal for this project.	ai	2026/06/02

Versions (showing 98 of 98)

Show 346 prereleases

Version	Deps	Published
19.2.7	1 / 0	2026-06-01
19.2.4	1 / 0	2026-01-26
19.2.3	1 / 0	2025-12-11
19.2.2	1 / 0	2025-12-11
19.2.1	1 / 0	2025-12-03
19.2.0	1 / 0	2025-10-01
19.1.8	1 / 0	2026-06-01
19.1.5	1 / 0	2026-01-26
19.1.4	1 / 0	2025-12-11
19.1.3	1 / 0	2025-12-11
19.1.2	1 / 0	2025-12-03
19.1.1	1 / 0	2025-07-28
19.1.0	1 / 0	2025-03-28
19.0.7	1 / 0	2026-06-01
19.0.4	1 / 0	2026-01-26
19.0.3	1 / 0	2025-12-11
19.0.2	1 / 0	2025-12-11
19.0.1	1 / 0	2025-12-03
19.0.0	1 / 0	2024-12-05
18.3.1	2 / 0	2024-04-26
18.3.0	2 / 0	2024-04-25
18.2.0	2 / 0	2022-06-14
18.1.0	2 / 0	2022-04-26
18.0.0	2 / 0	2022-03-29
17.0.2	3 / 0	2021-03-22
17.0.1	3 / 0	2020-10-22
17.0.0	3 / 0	2020-10-20
16.14.0	4 / 0	2020-10-14
16.13.1	4 / 0	2020-03-19
16.13.0	4 / 0	2020-02-26
16.12.0	4 / 0	2019-11-14
16.11.0	4 / 0	2019-10-22
16.10.2	4 / 0	2019-10-03
16.10.1	4 / 0	2019-09-28
16.10.0	4 / 0	2019-09-27
16.9.0	4 / 0	2019-08-08
16.8.6	4 / 0	2019-03-28
16.8.5	4 / 0	2019-03-22
16.8.4	4 / 0	2019-03-05
16.8.3	4 / 0	2019-02-21
16.8.2	4 / 0	2019-02-14
16.8.1	4 / 0	2019-02-06
16.8.0	4 / 0	2019-02-06
16.7.0	4 / 0	2018-12-20
16.6.3	4 / 0	2018-11-13
16.6.2	4 / 0	2018-11-13
16.6.1	4 / 0	2018-11-07
16.6.0	4 / 0	2018-10-23
16.5.2	4 / 0	2018-09-18
16.5.1	4 / 0	2018-09-13
16.5.0	4 / 0	2018-09-06
16.4.2	4 / 0	2018-08-01
16.4.1	4 / 0	2018-06-13
16.4.0	4 / 0	2018-05-24
16.3.3	4 / 0	2018-08-01
16.3.2	4 / 0	2018-04-16
16.3.1	4 / 0	2018-04-04
16.3.0	4 / 0	2018-03-29
16.2.1	4 / 0	2018-08-01
16.2.0	4 / 0	2017-11-28
16.1.2	4 / 0	2018-08-01
16.1.1	4 / 0	2017-11-13
16.1.0	4 / 0	2017-11-09
16.0.1	4 / 0	2018-08-01
16.0.0	4 / 0	2017-09-26
15.7.0	4 / 0	2020-10-14
15.6.2	4 / 0	2017-09-26
15.6.1	4 / 0	2017-06-15
15.6.0	4 / 0	2017-06-13
15.5.4	4 / 0	2017-04-11
15.5.3	4 / 0	2017-04-08
15.5.2	4 / 0	2017-04-08
15.5.1	4 / 0	2017-04-07
15.5.0	4 / 0	2017-04-07
15.4.2	3 / 0	2017-01-06
15.4.1	3 / 0	2016-11-23
15.4.0	3 / 0	2016-11-16
15.3.2	0 / 0	2016-09-19
15.3.1	0 / 0	2016-08-19
15.3.0	0 / 0	2016-07-29
15.2.1	0 / 0	2016-07-08
15.2.0	0 / 0	2016-07-01
15.1.0	0 / 0	2016-05-20
15.0.2	0 / 0	2016-04-30
15.0.1	0 / 0	2016-04-08
15.0.0	0 / 0	2016-04-07
0.14.10	0 / 0	2020-10-14
0.14.9	0 / 0	2017-04-12
0.14.8	0 / 0	2016-03-29
0.14.7	0 / 0	2016-01-28
0.14.6	0 / 0	2016-01-06
0.14.5	0 / 0	2015-12-29
0.14.4	0 / 0	2015-12-29
0.14.3	0 / 0	2015-11-19
0.14.2	0 / 0	2015-11-02
0.14.1	1 / 0	2015-10-28
0.14.0	1 / 0	2015-10-07
0.1.0	0 / 4	2014-05-06

v19.2.7

2 findings

HIGH Publisher changed: react-bot → GitHub Actions (on 2026-06-01) provenance

This version was published by a different npm account than previous versions on 2026-06-01. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v19.2.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v19.2.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v19.2.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v19.2.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v19.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v19.1.8

2 findings

HIGH Publisher changed: react-bot → GitHub Actions (on 2026-06-01) provenance

This version was published by a different npm account than previous versions on 2026-06-01. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v19.1.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v19.1.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v19.1.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v19.1.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v19.1.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v19.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v19.0.7

2 findings

HIGH Publisher changed: react-bot → GitHub Actions (on 2026-06-01) provenance

This version was published by a different npm account than previous versions on 2026-06-01. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v19.0.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v19.0.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v19.0.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v19.0.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v19.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v18.3.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v18.3.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v18.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v18.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v18.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.