@react-aria/tag

Build provenancecaution

No build attestation or trusted-publisher identity was recorded for this release. This leaves publication provenance less transparent, though it is not evidence that the release is unsafe.

Repo package mentioncaution

The repository name does not match the package and its README does not mention @react-aria/tag. While a monorepo name mismatch is ordinary, the missing package mention makes ownership of this specific package less explicit.

Workflow auditcaution

All 8 workflows were analyzed with no detected findings or untrusted checkouts, and permissions are read-only or job-scoped where reported. However, all 15 action references are unpinned, leaving avoidable action-version drift risk.