@stoplight/spectral-ref-resolver

Release historycaution

The package has had no registry release in the last 12 months and its latest release was nearly two years ago, which raises version freshness concerns. Recent repository activity partly offsets abandonment risk, but not the stale published release.

Repo package mentioncaution

The linked repository name does not match the package and its README does not mention the package, creating some uncertainty about package-to-repository linkage. The organization-backed monorepo context reduces, but does not eliminate, that concern.

Repo toolingcaution

The project uses TypeScript, npm scripts, and SWC, but no security-scanning tooling was detected. The missing scanner is a modest transparency and hygiene gap rather than evidence of unsafe code.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting expectations unclear. This is a maintenance and transparency gap, but it is not severe on its own.

Workflow auditcaution

The audit completed all six workflows and found no untrusted checkout or script-injection path, but 18 of 20 action references are unpinned and it reported high-confidence medium-severity secrets-inherit plus low-severity adhoc-packages findings. These are workflow hygiene concerns, not a standalone reason to reject the release.