@react-pdf/reconciler

Build provenancecaution

No build attestation or trusted-publisher provenance is present, so consumers have less verifiable evidence about how this release was produced.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention this package, so the package-to-source relationship is less transparent even though it may be a monorepo subpackage.

Repo toolingcaution

The repository uses established build tools including TypeScript, Rollup, Babel, and Vitest. It reports no security scanning tools, which is a modest transparency gap.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting and response expectations unclear.

Workflow auditcaution

All 19 analyzed action references are unpinned, and the release workflow installs packages outside a lockfile; both weaken reproducibility. However, there are no untrusted checkouts or script-injection findings, and the audit covered all three workflows.