@react-aria/utils

Build provenancecaution

No build attestation or trusted-publisher identity is present, so release-to-source provenance is less transparent. This is a supply-chain transparency gap, not evidence that the release is unsafe.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention this package. The organization-backed monorepo context makes a name mismatch understandable, but the missing explicit README mention slightly reduces package-specific transparency.

Token permissionscaution

Five workflows declare read-only permissions and none declare top-level write permissions. Three omit top-level permissions, leaving some avoidable configuration ambiguity but no observed excessive write access.

Version stabilitycaution

Version 3.34.1 is a stable-major, non-prerelease release. The recent prerelease share is 100%, which is a minor stability caution, but the assessed version itself is stable.