@stoplight/spectral-core

Dependency profilecaution

The release declares 22 runtime dependencies, a meaningful dependency surface that increases maintenance exposure, though the profile is not by itself evidence of poor health.

Repo toolingcaution

TypeScript, npm scripts, and SWC provide an established build, but no security-scanning tools were detected, leaving a modest transparency gap.

Security policycaution

No repository security policy was detected, which makes vulnerability reporting less explicit for users and maintainers.

Workflow auditcaution

All six workflows were analyzed with no untrusted checkouts or script injection, but 18 of 20 action references are unpinned; high-confidence secrets-inherit is medium severity, and adhoc-packages is low severity.