@react-stately/toggle

Build provenancecaution

No build attestation or trusted-publisher identity is present, limiting release provenance transparency. This is a moderate hygiene gap rather than evidence that the release is unsafe.

Repo package mentioncaution

The linked repository is a broader monorepo and neither matches the package name nor mentions it in the README, so package ownership is less transparent even though the organization backing is clear.

Workflow auditcaution

All eight workflows were analyzed with no reported audit findings, no untrusted checkout or script-injection paths, and scoped read-only or job-level permissions. However, all 15 action references are unpinned, leaving avoidable build-integrity risk.