react-test-renderer — Greenflagged

React package for snapshot testing.

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

fbreact-bot

Keywords

reactreact-nativereact-testing

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
bogus-package	bogus-package	AI (bogus-package): The 'fb' publisher flag is a false positive for the official Facebook/Meta React ecosystem packages. fb is the legitimate Facebook npm organization account, not a spam publisher.	ai	2026/04/23
phantom-deps	phantom-dep:react-is	AI (phantom-deps): react-is is a legitimate runtime dependency for react-test-renderer; it is used indirectly through bundled CJS output rather than direct ES import, making this a stable false positive.	ai	2026/04/23

Versions (showing 78 of 78)

Show 346 prereleases

Version	Deps	Published
19.2.5	2 / 0	2026-04-08
19.2.4	2 / 0	2026-01-26
19.2.3	2 / 0	2025-12-11
19.2.2	2 / 0	2025-12-11
19.2.1	2 / 0	2025-12-03
19.2.0	2 / 0	2025-10-01
19.1.5	2 / 0	2026-01-26
19.1.4	2 / 0	2025-12-11
19.1.3	2 / 0	2025-12-11
19.1.2	2 / 0	2025-12-03
19.1.1	2 / 0	2025-07-28
19.1.0	2 / 0	2025-03-28
19.0.7	2 / 0	2026-06-01
19.0.6	2 / 0	2026-05-06
19.0.5	2 / 0	2026-04-08
19.0.4	2 / 0	2026-01-26
19.0.3	2 / 0	2025-12-11
19.0.2	2 / 0	2025-12-11
19.0.1	2 / 0	2025-12-03
19.0.0	2 / 0	2024-12-05
18.3.1	3 / 0	2024-04-26
18.3.0	3 / 0	2024-04-25
18.2.0	3 / 0	2022-06-14
18.1.0	3 / 0	2022-04-26
18.0.0	3 / 0	2022-03-29
17.0.2	4 / 0	2021-03-22
17.0.1	4 / 0	2020-10-22
17.0.0	4 / 0	2020-10-20
16.14.0	4 / 0	2020-10-14
16.13.1	4 / 0	2020-03-19
16.13.0	4 / 0	2020-02-26
16.12.0	4 / 0	2019-11-14
16.11.0	4 / 0	2019-10-22
16.10.2	4 / 0	2019-10-03
16.10.1	4 / 0	2019-09-28
16.10.0	4 / 0	2019-09-27
16.9.0	4 / 0	2019-08-08
16.8.6	4 / 0	2019-03-28
16.8.5	4 / 0	2019-03-22
16.8.4	4 / 0	2019-03-05
16.8.3	4 / 0	2019-02-21
16.8.2	4 / 0	2019-02-14
16.8.1	4 / 0	2019-02-06
16.8.0	4 / 0	2019-02-06
16.7.0	4 / 0	2018-12-20
16.6.3	4 / 0	2018-11-13
16.6.2	4 / 0	2018-11-13
16.6.1	4 / 0	2018-11-07
16.6.0	4 / 0	2018-10-23
16.5.2	4 / 0	2018-09-18
16.5.1	4 / 0	2018-09-13
16.5.0	4 / 0	2018-09-06
16.4.2	4 / 0	2018-08-01
16.4.1	4 / 0	2018-06-13
16.4.0	4 / 0	2018-05-24
16.3.2	4 / 0	2018-04-16
16.3.1	4 / 0	2018-04-04
16.3.0	4 / 0	2018-03-29
16.2.0	3 / 0	2017-11-28
16.1.1	3 / 0	2017-11-13
16.1.0	3 / 0	2017-11-09
16.0.0	2 / 0	2017-09-26
15.7.0	2 / 0	2020-10-14
15.6.2	2 / 0	2017-09-26
15.6.1	2 / 0	2017-06-15
15.5.4	2 / 0	2017-04-09
15.5.3	2 / 0	2017-04-08
15.5.2	2 / 0	2017-04-08
15.5.1	2 / 0	2017-04-07
15.5.0	2 / 0	2017-04-07
15.4.2	2 / 0	2017-01-06
15.4.1	0 / 0	2016-11-23
15.4.0	0 / 0	2016-11-16
15.3.2	0 / 0	2016-09-19
15.3.1	0 / 0	2016-08-19
15.3.0	0 / 0	2016-07-29
1.1.0	2 / 3	2016-05-19
1.0.0	2 / 3	2016-05-17

v19.2.5

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: react-bot.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v19.2.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v19.2.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v19.2.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v19.2.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v19.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v19.1.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v19.1.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v19.1.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v19.1.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v19.1.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v19.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v19.0.7

2 findings

HIGH Publisher changed: react-bot → GitHub Actions (on 2026-06-01) provenance

This version was published by a different npm account than previous versions on 2026-06-01. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v19.0.6

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: react-bot.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v19.0.5

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: react-bot.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v19.0.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v19.0.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v19.0.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v19.0.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v19.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v18.3.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v18.3.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v18.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v18.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v18.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.