spring-core

Licensecaution

The artifact declares Apache-2.0 and includes license and notice files, with a matching repository license. The additional detected BSD-3-Clause text is not covered by the declaration, creating a minor metadata concern.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention this package, which creates a package-to-source traceability concern. The organization-backed Spring Framework monorepo context partly explains the mismatch but does not remove the missing explicit mention.

Repo toolingcaution

The project uses Gradle and has a structured repository, but no security-scanning tooling was detected. That is a modest transparency gap rather than evidence of abandonment.

Version stabilitycaution

This is a prerelease milestone, so it may change before final stabilization. The major line is established and only 15% of recent releases are prereleases, limiting the concern.

Workflow auditcaution

All 14 workflows were analyzed without failures, and no untrusted checkout or script-injection paths were found. The auditor reported high-confidence template-injection hygiene findings and six unpinned action references; because no dangerous trigger or sink corroborates them, these remain a limited workflow concern.