@react-email/hr

Registry deprecationdanger

npm marks the entire package as deprecated with no replacement, stating that it is no longer supported. This is a severe adoption and maintenance warning even though the source repository remains active.

Build provenancecaution

The release has no build attestation or trusted-publisher identity recorded, leaving publication provenance less transparent. The repository's active release workflows provide some operational context but do not replace an attestation.

Version stabilitycaution

Version 0.0.12 is not a stable-major release, so compatibility expectations are lower. It is not a prerelease, and the package has a multi-year release history to partly offset that concern.

Workflow auditcaution

All 11 workflows were analyzed with no untrusted checkouts or script-injection findings, and 9 use read-only permissions. High-confidence template-injection hygiene and trusted-publishing findings remain, with trusted publishing warranting caution even though no dangerous trigger was observed.