spring-expression

Repo package mentioncaution

The repository name does not match this artifact and its README does not mention the package, which is a caution under the package-ownership check; the organization-backed Spring monorepo context makes a submodule mismatch plausible but does not remove the transparency gap.

Repo toolingcaution

The project uses Gradle, but no security-scanning tools were detected; this is a modest transparency gap, partially offset by the project's separate security policy and active maintenance.

Version stabilitycaution

This is a prerelease milestone (7.1.0-M2), so API or behavior changes remain possible even though the major line is established and recent prereleases represent only 15% of releases.

Workflow auditcaution

All 14 workflows were analyzed with no untrusted checkout or script-injection findings, and most workflows use read-only or job-level permissions. Six of 24 action references are unpinned, and high-confidence template-injection findings are workflow hygiene concerns, but no dangerous trigger or sink corroborates them.