@react-aria/menu

Build provenancecaution

No build attestation or trusted-publisher identity is present, limiting verification of how this release was produced. This is a provenance gap, not evidence that the release is unsafe.

Repo package mentioncaution

The repository name does not match the package and its README does not mention @react-aria/menu, so the package-to-repository relationship is less explicit than ideal. The package README does identify it as part of react-spectrum, which provides some context but does not remove the transparency gap.

Token permissionscaution

Five of eight workflows declare read-only permissions and none declare top-level write permissions. Three workflows omit top-level permissions, leaving a modest workflow-hardening gap.