org.springframework:spring-context

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, creating some uncertainty about package-to-source mapping; the monorepo structure partly explains the name mismatch but not the absent mention.

Repo toolingcaution

The project uses Gradle, but no security-scanning tools were detected; the missing scanning evidence is a minor transparency gap for a major framework.

Version stabilitycaution

This is a milestone prerelease, but the package has a stable major line and only 15% recent prereleases, so the version status is a moderate rather than severe concern.

Workflow auditcaution

All 14 workflows were analyzed without untrusted checkouts or script-injection findings, and most use read-only or job-level permissions. Six of 24 action references are unpinned, and high-confidence template-injection findings are present; without a dangerous trigger or sink, these are workflow hygiene concerns rather than severe dependency risk.