@react-stately/autocomplete

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable even though other project signals are strong.

Repo package mentioncaution

The repository name does not match the package and its README does not mention this package, so the package-to-repository relationship is less transparent, although it is consistent with a monorepo sub-package.

Version stabilitycaution

This release is a beta and all recent releases are prereleases, so consumers should expect some API change risk despite the strong release cadence.

Workflow auditcaution

All 8 workflows were analyzed with no reported findings, and permissions are generally scoped or read-only; however, all 15 action references are unpinned, leaving avoidable update risk.