@lexical/overflow

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, so package-specific ownership is less explicit. The mismatch is compatible with a monorepo, but the lack of a README mention remains a transparency caution.

Version stabilitycaution

This release is not a prerelease, but 90% of recent releases are prereleases, which makes the broader version stream less predictable.

Workflow auditcaution

All 13 workflows were analyzed successfully, with 11 using read-only permissions, but all 16 action references are unpinned. Three high-confidence template-injection findings are hygiene concerns here because no pull_request_target, workflow_run, untrusted checkout, or script-injection trigger was reported.