@prisma/engines-version

Package scaffoldingcaution

A README is present and explicitly warns that this is an internal-use package whose release cycle can introduce breaking changes without warning. Missing tests and a changelog are expected packaging gaps and are not penalized.

Repo toolingcaution

The repository uses TypeScript build tooling, but no security-scanning tools were detected. The missing scanning is a modest hygiene gap rather than evidence of poor maintenance by itself.

Version stabilitycaution

The assessed release is a prerelease and all recent releases are prereleases, consistent with the README warning that breaking changes may arrive without notice. That lowers consumer predictability even though the major version is stable.

Workflow auditcaution

Both workflows were analyzed without untrusted checkouts, script injection, or write permissions, and one scopes permissions at job level. However, all 11 action references are unpinned and the publish workflow installs a package outside a lockfile, creating reproducibility and workflow-supply-chain hygiene concerns.