@salesforce/design-system-react

Build provenancecaution

The release has no build attestation or trusted publisher provenance, leaving publication origin less independently verifiable even though other repository evidence is strong.

Dependency profilecaution

The package declares 23 runtime dependencies, including several small utility packages and a Babel preset. This is a meaningful dependency surface to maintain, but it is not unusually risky on its own.

Release historycaution

The package has existed for about 8 years, with 105 releases and a latest release on September 16, 2026. Only two releases in the last year indicate a slower recent cadence despite the new release.

Repo commit activitycaution

The repository records zero commits and zero active maintainers in the last three months, which is a real maintenance concern. Recent release notes and three merged pull requests provide partial evidence of activity but do not remove the unusually quiet commit history.

Token permissionscaution

All three workflows lack top-level token permission declarations, and only one uses job-level permissions. This weakens least-privilege transparency for CI and publishing workflows.