@zag-js/toggle-group

Build provenancecaution

The release has no registry build attestation or trusted-publisher identity, leaving publication provenance less independently verifiable despite the active repository.

Security policycaution

The linked repository has no security policy, reducing transparency about how vulnerabilities should be reported; this is a documentation gap rather than evidence of abandonment.

Workflow auditcaution

All three workflows were analyzed with no untrusted checkouts, script injection, or audit findings, but 8 of 9 action references are unpinned and one workflow grants top-level write permissions. These are workflow hygiene and supply-chain risks, not severe findings on their own.