@react-aria/tree

Repo package mentioncaution

The repository name does not match the package name and its README does not mention @react-aria/tree, which creates some uncertainty about package-to-repository mapping. The package's placement in an organization-owned react-spectrum repository partly explains the mismatch but does not remove the documentation gap.

Workflow auditcaution

All 8 workflows were analyzed with no reported findings, no untrusted checkouts, no script injections, and read-only or job-level permissions in the observed workflows. However, all 15 action references are unpinned, leaving avoidable build-reproducibility and action-substitution risk.