@lexical/list

Repo package mentioncaution

The linked monorepo neither matches the package name nor mentions it in its README, creating some uncertainty about package-to-repository mapping. The organization-owned Lexical monorepo and package scope provide compensating context, so the concern is limited.

Version stabilitycaution

Version 0.52.0 is not a stable major version and 90% of recent releases are prereleases, so consumers should expect more API movement than with a mature stable-major package.

Workflow auditcaution

All 16 analyzed action references are unpinned, and high-confidence template-injection findings were reported; these are meaningful workflow hygiene concerns. However, no pull_request_target or workflow_run triggers, untrusted checkouts, or script-injection sinks were found, so this is not a severe dependency-health risk on its own.