@react-aria/calendar

Build provenancecaution

The release has no build attestation or trusted-publisher identity, leaving publication provenance less transparent despite the package's strong maintenance evidence.

Repo package mentioncaution

The repository name does not match the package and its README does not mention @react-aria/calendar, creating some uncertainty about package-to-repository linkage; the organization's monorepo structure partly explains the name mismatch but not the absent mention.

Workflow auditcaution

All 8 workflows were analyzed with no audit findings, no untrusted checkout or script-injection sinks, and read-only or job-scoped permissions; however, all 15 action references are unpinned, which weakens build reproducibility.