@orval/core

Repo package mentioncaution

The repository name differs from the package name and its README does not mention @orval/core, creating some uncertainty about the package-to-repository link; the organization and package namespace partially compensate because this may be a monorepo subpackage.

Workflow auditcaution

All 23 action references are unpinned, four workflows grant top-level write permissions, and high-confidence template-injection findings appear in release preparation; the audit found no untrusted checkout or script-injection sink, so this is workflow hygiene rather than a severe dependency risk.