@graphql-tools/optimize

Project backingcaution

The package is linked to a repository owned by an individual account rather than an organization account, so there is no organizational backing signal to offset contributor concentration; active commit and release activity nevertheless provides substantial maintenance evidence.

Repo bus factorcaution

Seven contributors were active, but the top contributor accounts for about 59% of commits; this is some concentration risk, partially offset by the six additional active contributors.

Repo package mentioncaution

The linked repository neither matches the package name nor mentions the package in its README, creating a genuine linkage-transparency concern that should be verified even though the repository appears to be a large monorepo.

Token permissionscaution

Two workflows lack top-level permissions and two declare write permissions, so CI permissions are not uniformly minimized; this is a workflow-hardening concern rather than evidence of unsafe behavior by itself.

Version stabilitycaution

Version 2.0.1 is a stable major and is not a prerelease, but 95% of recent versions are prereleases, which raises some release-process stability concern.