formik
Build forms in React, without the tears
20
Versions
Apache-2.0
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
jaredpalmer
Keywords
formikformformsreactreact-domhooksreact hooksvalidationrender propsvalidationhigher order componenthoc
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | missing-githead | AI (provenance): Formik is a long-established package by a trusted maintainer; missing gitHead reflects a local publish environment change, not a security concern for this package. | ai | |
| provenance | no-provenance | AI (provenance): Formik is a long-established package by a trusted publisher; lack of Sigstore provenance is a best-practice gap, not a security risk for this package. | ai | |
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): tslib is a declared runtime dependency used implicitly by TypeScript-compiled output; this is expected behavior for formik and stable across versions. | ai |
Versions (showing 20 of 120)
| Version | Deps | Published |
|---|---|---|
| 0.8.0 | 0 / 29 | |
| 0.7.2 | 1 / 21 | |
| 0.7.1 | 1 / 21 | |
| 0.7.0 | 3 / 17 | |
| 0.6.3 | 4 / 16 | |
| 0.6.2 | 4 / 16 | |
| 0.6.1 | 4 / 16 | |
| 0.6.0 | 4 / 16 | |
| 0.5.3 | 4 / 16 | |
| 0.5.2 | 4 / 16 | |
| 0.5.1 | 3 / 16 | |
| 0.5.0 | 3 / 16 | |
| 0.4.0 | 3 / 16 | |
| 0.3.1 | 3 / 16 | |
| 0.3.0 | 3 / 16 | |
| 0.2.0 | 3 / 16 | |
| 0.1.1 | 3 / 16 | |
| 0.1.0 | 4 / 16 | |
| 0.0.2 | 4 / 16 | |
| 0.0.1 | 4 / 16 |