@ariakit/react

Repo toolingcaution

The project uses established TypeScript, Vitest, Vite, tsup, and Rolldown build tooling. No security scanning tools were detected, which is a minor transparency gap but not enough to outweigh the active project evidence.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations less explicit.

Version stabilitycaution

Version 0.4.41 is not a stable major version, but it is not a prerelease and recent releases contain no prerelease versions, so this is only a modest maturity limitation.

Workflow auditcaution

All 12 workflows were analyzed, with no untrusted checkout or script-injection counts, but 68 of 75 action references are unpinned. High-confidence template-injection findings, repeated secrets inheritance, ad hoc package installation, and trusted publishing further weaken workflow hygiene, although no top-level write permissions were found.