@react-stately/tree

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable despite the package’s strong maintenance evidence.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, so the package-to-repository link is less transparent; the monorepo context makes a name mismatch understandable but does not resolve the missing mention.

Version stabilitycaution

The current release is a stable major version and is not a prerelease, although all recent releases were marked prereleases, which makes the recent release pattern somewhat noisy.

Workflow auditcaution

All eight workflows were analyzed with no audit findings, no untrusted checkout or script-injection paths, and scoped read-only or job-level permissions; however, all 15 action references are unpinned, which weakens reproducibility.