@theguild/federation-composition

Repo toolingcaution

The project uses TypeScript, Vitest, and npm scripts for its build and tests, but no security-scanning tools were detected.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations unclear; this is a transparency gap rather than evidence of abandonment.

Version stabilitycaution

Version 0.27.0 is not prerelease, but 75% of recent releases were prereleases, so release-channel stability is somewhat mixed.

Workflow auditcaution

Both workflows were analyzed with no dangerous findings, untrusted checkouts, or script injections. Three of nine action references are unpinned and one workflow has top-level write permissions, creating minor reproducibility and token-scope concerns.