@firebase/auth-compat

Build provenancecaution

No build attestation or trusted-publisher metadata was provided, leaving release provenance less independently verifiable than it could be.

Repo package mentioncaution

The linked repository name does not match the package and its README does not mention @firebase/auth-compat. A name mismatch is ordinary for a monorepo, but the absence of a README mention leaves a minor ownership-transparency concern.

Repo toolingcaution

The repository uses established build tools including Nx, Rollup, Webpack, TypeScript, and Babel, though no security-scanning tools were detected.

Version stabilitycaution

Version 0.6.12 is not a stable-major release, and 70% of recent releases are prereleases, which adds some maturity uncertainty despite the current release itself not being prerelease.

Workflow auditcaution

All 21 workflows were analyzed, all 106 action references are pinned, and permissions are read-only or job-scoped. A high-severity cache-poisoning pattern was low confidence and therefore remains hygiene, while high-confidence ad hoc package installation is a minor workflow concern.