@vendure/core

Dependency profilecaution

Forty-one runtime dependencies make this a substantial framework with a meaningful dependency surface, but the profile is consistent with its broad ecommerce and server functionality.

Maintainerscaution

The package has five publishing accounts and an organization-backed primary domain, but three accounts use consumer or outside domains: oliverstreissi (gmail.com), michaelbromley (michaelbromley.co.uk), and dlhck (elevantiq.com). This is an account-hygiene caution, partly offset by the active organization and broad repository contributors.

Workflow auditcaution

All 14 workflows were analyzed with no untrusted checkouts or script injection, and all 63 action references are pinned. High-confidence findings include an unpinned container image, archived action use, and ad hoc package installs; these are workflow hygiene concerns, not evidence that the release is unfit.