@fontsource/roboto

Self-host the Roboto font in a neatly bundled NPM package.

Latest 5.3.0

NPM

78%

Total Score

healthy

Healthy: active maintenance and a current release outweigh workflow pinning and package-ownership clarity gaps.

Health Score Breakdown

Repo issue activity

The repository has ongoing issue activity and merged pull requests, though three new issues and no issues closed in the last month suggest some backlog. This is a minor concern rather than abandonment evidence.

Repo package mention

The repository name does not match the package name and its README does not mention @fontsource/roboto. Although a mismatch is normal for a monorepo, the lack of an explicit package mention leaves ownership linkage less clear.

Repo tooling

No build tool or security scanning tool was detected. For a generated font-asset repository this is a transparency and hygiene gap, but it is partly offset by the active repository and published provenance.

Security policy

The repository has no security policy. This modestly reduces disclosure transparency, but it does not indicate abandonment or make this static asset package unfit to use.

Workflow audit

All 19 analyzed action references are unpinned, which weakens workflow reproducibility. Five workflows grant top-level write permissions, but there are no untrusted checkouts, script injections, or high-confidence audit findings, so this remains a hygiene caution.