@tanstack/devtools-event-client

Repo package mentioncaution

The repository name differs from the package and its README does not mention this package, creating some uncertainty about package-to-source mapping; the organization-owned monorepo context partly reduces that concern.

Security policycaution

No repository security policy was found, leaving vulnerability reporting expectations undocumented despite the project's other security tooling.

Version stabilitycaution

Version 0.5.0 is not yet at a stable major version, so breaking changes remain possible, but it is not a prerelease and recent releases show a consistent cadence.

Workflow auditcaution

All nine workflows were analyzed with no untrusted checkouts, script injection, top-level write permissions, or unpinned actions. Two high-confidence low-severity findings show packages installed outside a lockfile, which is a modest CI hygiene concern; the cache-poisoning finding is low confidence.