@internationalized/date

Build provenancecaution

No build attestation or trusted-publisher identity was observed, leaving publication provenance less independently verifiable despite the package's otherwise strong maintenance evidence.

Dangerous workflowscaution

One of eight workflows uses pull_request_target, which warrants review because that trigger can be sensitive, but there are no untrusted checkouts or script-injection findings.

Token permissionscaution

Five workflows declare read-only permissions and none declare top-level write access. Three workflows omit top-level permissions, leaving a modest configuration-transparency gap but no observed excessive write permission.