@firebase/firestore-compat

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable despite the package's strong project backing and activity.

Maintainerscaution

Three of four publishing accounts use the Google domain, and the linked project is organization-owned; the single gmail.com publishing account is a minor account-hygiene concern, not evidence of a thin maintenance team.

Repo toolingcaution

The repository uses established build tools including TypeScript, Rollup, Webpack, Babel, Nx, and npm scripts. No security-scanning tools were detected, but the repository has a security policy and other evidence of mature project operations.

Version stabilitycaution

Version 0.4.15 is not prerelease, although 75% of recent versions were prereleases and the package remains below 1.0; this is a mild maturity concern but not a release blocker.

Workflow auditcaution

All 21 workflows were analyzed, all 106 action references are pinned, and permissions are read-only or job-scoped. The high-severity cache-poisoning finding has low confidence, while the high-confidence adhoc-packages finding is a minor workflow hygiene concern.