@octokit/rest

Release historycaution

The package has been maintained since 2018 with 303 releases, but only one release occurred in the last 12 months, indicating a currently slower cadence than its historical median of about 3 days.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers over the last three months, a meaningful maintenance warning despite the recent push timestamp.

Workflow auditcaution

All seven workflows were analyzed, but four high-confidence findings report GitHub app tokens inheriting blanket installation permissions, one medium-confidence finding uses an archived action, and 15 of 21 action references are unpinned. The pull_request_target workflows had no reported untrusted checkout or script-injection sinks, so this is workflow hygiene and permission risk rather than a severe standalone dependency verdict.