@react-aria/live-announcer

Build provenancecaution

No build attestation or trusted-publisher setup was reported, leaving release provenance less transparent despite the package's otherwise active project evidence.

Repo package mentioncaution

The linked repository does not match the package name and its README does not mention this package, creating a modest package-to-repository traceability gap; the broader project backing partly offsets it.

Workflow auditcaution

All 15 analyzed action references are unpinned, which weakens workflow reproducibility and action supply-chain control. The audit found no high- or medium-severity findings, no untrusted checkout, and no script injection.