@react-pdf/layout

Repo bus factorcaution

One contributor made about 60% of recent commits, but 17 contributors were active and another made 25%, so concentration is a mild concern rather than a severe dependency risk.

Repo package mentioncaution

The repository name does not match this sub-package and its README does not mention @react-pdf/layout, so package-to-repository ownership is less transparent even though a monorepo can legitimately host sub-packages.

Repo toolingcaution

The project uses established build and test tooling, but no security-scanning tools were detected, leaving a modest security-process gap.

Security policycaution

The repository has no security policy, reducing transparency for reporting and handling vulnerabilities, though active maintenance partly offsets the concern.

Workflow auditcaution

All three workflows were analyzed with no untrusted checkouts or script injection, but all 19 action references are unpinned and the release workflow has two high-confidence adhoc-package findings. These are hygiene concerns, not severe risks on their own.