@cubejs-backend/api-gateway

Dependency profilecaution

The package has 24 runtime dependencies for an API gateway with HTTP, GraphQL, authentication, and query-orchestration responsibilities; this is substantial but consistent with its scope.

Maintainerscaution

Two publish accounts use the cube.dev domain, but keydunov (gmail.com) and statsbot (statsbot.co) are outside-domain publishing accounts. The organization backing compensates for some account concentration, but these accounts add account-hygiene risk.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention this package. The package is plausibly a monorepo subpackage, but the missing direct mention leaves some ownership transparency uncertainty.

Workflow auditcaution

All 17 workflows were analyzed, but all 253 action references are unpinned, and the audit found high-confidence template-injection findings plus secrets inheritance, archived actions, and ad hoc package installation. Pull-request-target and workflow-run triggers had no untrusted checkout or script-injection findings, so these remain workflow-hygiene concerns rather than a severe release risk.