@graphql-yoga/subscription

Release historycaution

The package has existed for about 4 years and has 1,440 releases, but only 2 releases occurred in the last 12 months, indicating a slower recent release cadence despite the latest release being current.

Repo package mentioncaution

The repository name differs from the package name and its README does not mention this package, creating some uncertainty about package-to-repository ownership. The name mismatch is compatible with a monorepo, but the missing README mention warrants caution.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented. This is a transparency gap, but active maintenance and security scanning partly compensate.

Token permissionscaution

Five of six workflows lack top-level permissions declarations, and the release workflow grants top-level write access, so workflow privileges are not consistently minimized. The absence of dangerous workflow patterns limits the practical concern.