@zag-js/element-size

Build provenancecaution

No build attestation or trusted-publishing provenance is present, leaving the published artifact's origin less independently verifiable.

Release historycaution

The latest release was over 17 months ago, with no releases in the last 12 months. Active repository work partly offsets this, but the package's publication cadence is still a maintenance concern.

Repo package mentioncaution

The repository name does not match the package and its README does not mention @zag-js/element-size, so package ownership is less directly transparent; the monorepo context partly explains the name mismatch but not the missing mention.

Security policycaution

The repository has no security policy, reducing transparency about how vulnerabilities should be reported and handled.

Workflow auditcaution

The audit completed cleanly with no dangerous triggers or findings, but 8 of 9 action references are unpinned and one workflow grants top-level write access, creating workflow reproducibility and permission-hygiene concerns.