spring-webmvc

Repo toolingcaution

The project uses Gradle, but no security-scanning tools were detected. That is a modest transparency gap, partly offset by the repository's active development and separate security policy.

Version stabilitycaution

This is a prerelease M2 version of an otherwise stable major line, so API or behavior changes remain more likely than in a final release.

Workflow auditcaution

All 14 workflows were analyzed successfully, with no untrusted checkouts or script-injection findings; nine workflows use read-only permissions and only six of 24 action references are unpinned. High-confidence template-injection findings and one top-level write permission are workflow hygiene concerns, but without a dangerous trigger and sink they do not independently indicate package unfitness.