@graphql-yoga/logger

Package scaffoldingcaution

The published artifact has no README, which is a consumer-facing documentation gap for a library. The source repository does provide tests and a changelog, partly compensating for the missing package documentation.

Release historycaution

The package has 305 releases over roughly 3.5 years and a release today, but only one release in the last 12 months indicates a slower release cadence. The current release and substantial history reduce abandonment concern.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention this package, so the package-to-repository relationship is not directly transparent. The organization-backed monorepo context makes a subpackage explanation plausible, but the missing mention remains a caution.

Security policycaution

No security policy was found in the repository. This weakens vulnerability-reporting transparency, although the active project and other security controls provide some compensation.

Token permissionscaution

Five of six workflows lack top-level permission declarations, and the release workflow has top-level write permissions. Explicit least-privilege settings would provide stronger workflow security hygiene.