@react-aria/progress

Build provenancecaution

No build attestation or trusted-publisher metadata is present, leaving publication provenance less transparent than it could be.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, so the package-to-repository relationship is less transparent despite the package belonging to a broader project.

Workflow auditcaution

All eight workflows were analyzed with no reported audit findings, no untrusted checkouts, and no script injection. However, all 15 action references are unpinned, which weakens build reproducibility and leaves dependency references exposed to drift.