@lingo.dev/compiler

Dangerous workflowscaution

One of eight workflows uses pull_request_target, but there are no untrusted checkouts or detected script-injection patterns; the isolated finding warrants awareness rather than a severe health penalty.

Dependency profilecaution

The package declares 25 runtime dependencies, including multiple AI providers and build-transformation libraries; this increases dependency and update surface compared with a small focused package, but fits its compiler and translation features.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations and response procedures undocumented.

Token permissionscaution

None of the eight workflows declares top-level permissions, although six specify permissions at job level and none has top-level write access; this is a workflow-hardening gap rather than evidence of unsafe behavior by itself.

Version stabilitycaution

Version 0.4.14 is not yet at a stable major version, but it is not a prerelease and recent releases contain no prerelease versions, so the main concern is API maturity rather than release instability.