@graphql-tools/merge

Maintainerscaution

Five accounts can publish, with two using the primary the-guild.dev domain. The three Gmail accounts—urigo, ardatan, and enisdenjo—are account-hygiene concerns, though they do not indicate limited maintenance capacity by themselves.

Repo bus factorcaution

One contributor made 62.5% of recent commits, which is concentrated, but seven other contributors were active during the same three-month period.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention @graphql-tools/merge, so the package-to-repository link is less transparent; this may still be expected for a monorepo sub-package.

Workflow auditcaution

All four workflows were audited with no findings or untrusted checkouts. Eight of 22 action references are unpinned and two workflows grant top-level write permissions, but no untrusted trigger or sink makes these severe.