@react-email/code-block

Registry deprecationdanger

The package is deprecated at registry scope with the message “Package no longer supported” and no replacement package, which is a severe adoption risk despite the active source repository.

Workflow auditcaution

All 11 workflows were analyzed with no untrusted checkout or script-injection trigger combination and all action references pinned. A high-confidence template-injection finding and trusted-publishing finding remain workflow hygiene concerns, but they do not outweigh the package deprecation alone.