@pnpm/dependency-path

Repo package mentioncaution

The repository name does not match the package name and its README does not mention this package, so the link is less transparent. The package appears alongside many pnpm packages in a large monorepo, which partly explains the mismatch but does not remove the documentation gap.

Workflow auditcaution

All 26 workflows were analyzed successfully, action references are fully pinned, and there are no untrusted checkouts or script injections. The high-confidence low-severity finding that the release workflow installs a package outside a lockfile is a real reproducibility weakness, but not a severe risk by itself.