@shadcn/react

Repo package mentioncaution

The repository name does not match the package and its README does not mention @shadcn/react, so the link may be a monorepo or package association that consumers should verify.

Version stabilitycaution

Version 0.3.1 is not a stable major release, so the public API may still change, although it is not marked prerelease and recent releases contain no prerelease versions.

Workflow auditcaution

All 11 workflows were analyzed with no high- or medium-severity findings and no untrusted checkout or script-injection paths. However, all 62 action references are unpinned, and two high-confidence low-severity findings report ad hoc package installation in the release workflow; these are workflow supply-chain hygiene concerns.