@react-aria/dialog

Build provenancecaution

No build attestation or trusted-publisher provenance is reported, leaving the connection between the published artifact and its build less transparent despite the active source repository.

Repo package mentioncaution

The repository name differs from the package name and its README does not mention this package, creating some uncertainty about package-to-repository traceability; the organization-backed monorepo context partly offsets that concern.

Workflow auditcaution

All eight workflows were analyzed with no reported findings, no untrusted checkout or script-injection sinks, and scoped or read-only permissions in the observed workflows. However, all 15 action references are unpinned, weakening build reproducibility and action supply-chain control.