@react-stately/data

Build provenancecaution

No build attestation or trusted-publisher identity is present, leaving publication provenance less verifiable even though the package has strong release and repository activity.

Repo package mentioncaution

The repository name does not match the package and its README does not mention @react-stately/data, so the package-to-repository linkage is less transparent; the monorepo context partly explains the name mismatch but not the missing README mention.

Workflow auditcaution

All eight workflows were analyzed with no findings and no untrusted checkout or script-injection paths. However, all 15 action references are unpinned, a minor reproducibility and workflow supply-chain hygiene gap.