@reactflow/node-resizer

Release historycaution

The package has had no releases in the last two years, which raises maintenance and compatibility concerns. Its 33 releases and roughly weekly historical cadence show prior maturity, but do not offset the current pause entirely.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, so the package-to-source relationship is less transparent than expected. The organization-owned monorepo context makes a name mismatch ordinary, but the missing README mention remains a caution.

Repo toolingcaution

The project uses established build tooling including Turbo, Rollup, npm scripts, and TypeScript. No security scanning tools were detected, leaving a modest security-process gap.

Workflow auditcaution

All six referenced actions are unpinned, and the audit found a high-confidence template-injection issue in dispatchWebsiteUpdate.yaml. The template-injection result is a workflow hygiene concern, while fully unpinned actions increase build reproducibility and supply-chain risk.