@ckeditor/ckeditor5-heading

Build provenancecaution

The package has no attestation, so consumers cannot independently verify its build origin from registry metadata. A CircleCI trusted publisher is present, which partly offsets this transparency gap.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention this package, creating a minor identity-transparency concern. The organization-owned monorepo context makes a subpackage layout plausible.

Version stabilitycaution

Version 49.0.0 is a stable major release rather than a prerelease. The recent prerelease share of 95% is a minor caution, although it does not make this release itself unstable.