@graphql-tools/batch-execute

Repo package mentioncaution

The linked repository is named gateway rather than batch-execute and does not mention the package in its README. Because the repository also lacks a direct package reference, the source association is less transparent and should be verified as an intended monorepo backing.

Security policycaution

No security policy was found in the linked repository. This is a transparency and vulnerability-reporting gap, though it is mitigated somewhat by the repository's security scanning tools.

Token permissionscaution

All six workflows lack top-level permissions declarations, and none declares read-only permissions. Although no workflow has top-level write permissions and only one relies on job-level permissions, explicit least-privilege declarations would improve CI security hygiene.

Version stabilitycaution

Version 10.2.0 is a stable major release and is not itself a prerelease, which supports dependability. However, 85% of recent versions are prereleases, so release-channel discipline is a modest transparency concern.