spring-ai-client-chat

Repo package mentioncaution

The repository name does not match this module and its README does not mention the package, creating some uncertainty about package-to-source mapping; the organization-owned multi-module layout partly explains the mismatch but does not remove it.

Repo toolingcaution

The repository uses Maven but reports no security-scanning tools, leaving a modest tooling gap; its active maintenance and separate security policy provide some compensation.

Version stabilitycaution

This release is a milestone prerelease, and 40% of recent releases are prereleases, which increases compatibility uncertainty despite a stable major version.

Workflow auditcaution

The audit analyzed all 17 workflows and found high-confidence template-injection and unpinned-image findings, plus 78 of 88 action references unpinned. No pull_request_target or workflow_run trigger or untrusted checkout was reported, so these are build-hygiene concerns rather than severe workflow exposure on the provided evidence.