@sentry/integrations

Build provenancecaution

No build attestation or trusted-publisher identity is present, leaving publication provenance less transparent. This is a meaningful but non-severe gap because the package has strong organization backing and active source maintenance.

Release historycaution

The package has 395 releases since March 2019, but none in the last 12 months and its latest registry release was about 14 months ago. Active repository work partly offsets this release-cadence concern.

Workflow auditcaution

The audit analyzed all 26 workflows with no failed files and found no untrusted checkout or script-injection paths. However, it reports high-confidence blanket GitHub App permissions, 145 of 164 action references unpinned, an archived action, and medium-confidence template-injection findings; the low-confidence cache findings are not weighted heavily.