@react-email/heading

Registry deprecationdanger

npm marks the entire package as deprecated with the message “Package no longer supported,” rather than withdrawing only this release. That is a severe direct warning against taking a new dependency on it.

Release historycaution

The package has existed for about four years, with 21 releases and two releases in the last 12 months. This shows established history but a relatively limited recent release cadence.

Workflow auditcaution

All 11 workflows were analyzed and all 24 action references are pinned, but the audit found a high-confidence template-injection issue and a trusted-publishing concern. No untrusted checkout or script-injection path was reported.