@firebase/functions-compat

Build provenancecaution

No build attestation or trusted-publisher evidence is present, leaving publication provenance less transparent than it could be. This is a modest concern rather than evidence of an unhealthy project.

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, so package ownership is less explicit. Because the repository is the Firebase monorepo, the mismatch is consistent with a sub-package, but the missing README mention remains a minor transparency gap.

Repo toolingcaution

The repository uses established build tools including TypeScript, Rollup, Webpack, Babel, and Nx. No security-scanning tools were detected, which is a minor tooling gap, but the repository does provide a security policy.

Version stabilitycaution

Version 0.5.0 is not at a stable major version, and 80% of recent releases are prereleases, so API maturity is less certain despite the strong release cadence.

Workflow auditcaution

All 21 workflows were analyzed, all 106 action references are pinned, and no untrusted checkout or script-injection paths were found. The audit also reported a low-confidence cache-poisoning finding and a high-confidence low-severity adhoc package installation, which are limited hygiene concerns.