{
  "schemaVersion": 1,
  "type": "resource",
  "id": "react-aria",
  "evaluation": {
    "reviewedOn": "2026-10-19",
    "status": "checked",
    "modes": [
      "http",
      "browser"
    ],
    "summary": "The official checkbox changed state with Space and with its visible label, then returned to its initial state. Enabling the demo's disabled setting prevented a synthetic Space event from changing selection. No package or application workflow was installed.",
    "reportUrl": "/design-evaluations/resource-react-aria.json",
    "identity": {
      "target": "https://react-aria.adobe.com/Checkbox",
      "version": "Unversioned public demo observed 2026-10-19; registry snapshot react-aria-components 1.22.1 was not locally executed.",
      "integrity": "Public document SHA-256 4c46cdb5b8e5f487d07d36c1b801340a9ce4343a5aa80bd39ab7236e5d88e003; initial response only, not complete application integrity. Source snapshot 261344335e54265b2d02dc57a43b911a718de707 does not identify the hosted deployment."
    },
    "environment": [
      "Chrome 155.0.8059.82, 1280 x 900 desktop viewport; UTC browser context.",
      "Fresh temporary browser profile and context; no inherited account storage. Child environment allowed only runtime paths, with credential variables omitted.",
      "Public HTTPS GET/HEAD only; form submission, non-read methods, WebSockets, service workers and downloads blocked. Selected telemetry requests were blocked."
    ],
    "tests": [
      {
        "name": "Public sample response",
        "mode": "http",
        "method": "Anonymous public GET; capture status, response-body hash and selected headers.",
        "result": "pass",
        "observation": "HTTP 200; https://react-aria.adobe.com/Checkbox. Reachability only."
      },
      {
        "name": "Keyboard selection cycle",
        "mode": "browser",
        "method": "Focus the first documented checkbox/switch; press Space twice and inspect its checked state.",
        "result": "pass",
        "observation": "Checked false -> true -> false. No external form submitted."
      },
      {
        "name": "Pointer selection cycle",
        "mode": "browser",
        "method": "Click the same sample control twice and inspect state restoration.",
        "result": "pass",
        "observation": "Pointer toggled state=true; original state restored=true."
      },
      {
        "name": "Disabled sample boundary",
        "mode": "browser",
        "method": "Inspect a documented disabled control and try a synthetic Space key event without force-clicking or altering properties.",
        "result": "pass",
        "observation": "Disabled=true; checked unchanged=true. Programmatic events only; tab-order test not included."
      }
    ],
    "security": {
      "scope": "Passive inspection of official public response headers and request hosts, declared package metadata, and the exact local fixture where stated. No exploitation, authentication, private input or backend writes.",
      "findings": [
        {
          "level": "caution",
          "basis": "observed",
          "title": "Visible label and input are separate targets",
          "detail": "The raw hidden-input pointer probe timed out; clicking the associated visible label worked and keyboard Space changed the native input state. Preserve the label relationship when changing layout instead of removing the input."
        },
        {
          "level": "info",
          "basis": "observed",
          "title": "Sampled response and request surface",
          "detail": "The anonymous HTTPS demo response included content-security-policy, strict-transport-security. Requests attempted 1 additional host(s), including use.typekit.net. The guard blocked 0 request(s). Host attempts include blocked requests; this does not establish retained data or exploit resistance."
        },
        {
          "level": "caution",
          "basis": "advice",
          "title": "Check the installed dependency graph separately",
          "detail": "The registry snapshot identifies react-aria-components 1.22.1, but this review did not install or audit it. Lock and review the versions that actually enter your application; the hosted demo's success is not a dependency audit."
        }
      ],
      "limits": [
        "No authentication, authorization, tenant isolation, retention or backend processing was tested.",
        "No comprehensive source/dependency audit, vulnerability scan or security certification. Header presence or absence describes one response, not the safety of a product.",
        "Request guards can alter normal page behavior. Full browser, mobile, assistive-technology and performance coverage is outside this evaluation."
      ]
    },
    "practicalCaveats": [
      "A hidden native input may be the keyboard target while the visible label is the pointer target. Preserve both when restyling.",
      "A disabled control is a user-interface state, not permission enforcement.",
      "Publisher accessibility claims and this checkbox sample do not certify every composite interface you build."
    ],
    "limits": [
      "Only the checkbox demo was exercised. Calendars, drag and drop, tables, localization and screen-reader behavior remain untested.",
      "The disabled check used programmatic key events after toggling a demo setting; it did not establish full tab-order behavior."
    ],
    "sources": [
      {
        "label": "Official documentation",
        "url": "https://react-aria.adobe.com/getting-started"
      },
      {
        "label": "Official evaluated sample",
        "url": "https://react-aria.adobe.com/Checkbox"
      },
      {
        "label": "Upstream repository",
        "url": "https://github.com/adobe/react-spectrum"
      },
      {
        "label": "GitHub repository snapshot endpoint",
        "url": "https://api.github.com/repos/adobe/react-spectrum",
        "scope": "Star count and repository identity observed 2026-10-19."
      },
      {
        "label": "Sampled source revision",
        "url": "https://github.com/adobe/react-spectrum/commit/261344335e54265b2d02dc57a43b911a718de707",
        "scope": "Default branch snapshot; not a claim that the hosted demo deploys this exact commit."
      },
      {
        "label": "Package manifest snapshot",
        "url": "https://registry.npmjs.org/react-aria-components/1.22.1",
        "scope": "Exact registry version and dependency/license declaration; installed only where the evaluation says so."
      },
      {
        "label": "React Aria overview",
        "url": "https://react-aria.adobe.com/"
      }
    ]
  }
}