@react-aria/toast

Build provenancecaution

No build attestation or trusted-publisher identity was provided, leaving release provenance less verifiable despite the package's strong maintenance evidence.

Repo package mentioncaution

The linked repository name does not match the package and its README does not mention @react-aria/toast. This may be normal for a monorepo, but the missing package reference weakens package-to-repository transparency.

Workflow auditcaution

All eight workflows were analyzed without failed files or audit findings, and permissions are scoped or read-only in the observed workflows. However, all 15 action references are unpinned, leaving a supply-chain hygiene gap.