@parcel/core

Workflow auditdanger

All 49 analyzed action references are unpinned, and the release workflow has three high-confidence template-injection findings; reusable workflows also inherit secrets. The audit was complete, while the low-confidence cache findings are only hygiene concerns.

Build provenancecaution

No build attestation or trusted-publisher identity is present, leaving release provenance less transparent despite the package's broader project maturity.

Dependency profilecaution

The package has 25 runtime dependencies, including many internal Parcel modules. This is a meaningful dependency surface, but it is consistent with a mature build-system core rather than an unexplained minimal package.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers over the last three months, a material maintenance warning despite a recent push and continued registry releases.

Repo issue activitycaution

Issues and pull requests remain active, with three new and three closed issues and eight new pull requests in the last month. No pull requests were merged in that period, so this is supportive but not fully reassuring.