@react-spring/three

Repo issue activitycaution

There were no new or closed issues in the last month and no merged pull requests, with only one new pull request. This is a modest maintenance-activity concern, but it is outweighed by recent commits and releases.

Repo toolingcaution

The repository uses TypeScript, Vitest, Turbo, Vite, SWC, and npm scripts, showing an established build and test setup. No security scanning tools were detected, leaving a modest assurance gap.

Security policycaution

The repository has no security policy. That weakens vulnerability-reporting transparency, although it does not by itself indicate abandonment.

Workflow auditcaution

All 42 analyzed action references are unpinned, which is a meaningful CI supply-chain hygiene weakness. The audit found no high- or medium-severity issues, no untrusted checkouts or script injection, and only high-confidence low-severity adhoc-package findings; one workflow also has top-level write permissions.