react-map-gl
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| maintainer-change | maintainer-added | AI (maintainer-change): vis.gl org restructure; new maintainers are known contributors to the project. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Old maintainers removed as part of org restructure; consistent with v8 rewrite history. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Dormancy reflects major version rewrite under vis.gl org; not indicative of takeover. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): New deps are first-party vis.gl packages created as part of the v8 architectural split. | ai | |
| source-diff | large-new-source-files | AI (source-diff): 88 new files reflect the v8 rewrite bundling mapbox and maplibre variants; expected for this major version. | ai |
Versions (showing 8 of 8)
| Version | Deps | Published |
|---|---|---|
| 8.1.1 | 2 / 2 | |
| 8.1.0 | 2 / 2 | |
| 8.0.4 | 2 / 2 | |
| 8.0.3 | 2 / 2 | |
| 8.0.2 | 2 / 2 | |
| 8.0.1 | 2 / 2 | |
| 8.0.0 | 2 / 2 | |
| 7.0.23 | 1 / 18 |
v8.0.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.0.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.0.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.0.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.