better-ajv-errors

Build provenancecaution

The release has no build provenance attestation or trusted-publisher identity, so consumers cannot independently verify how the artifact was produced.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Although it was pushed recently and released recently, the lack of observed commit activity is a maintenance concern.

Repo issue activitycaution

There were no new or closed issues in the last month, while 32 pull requests remain open and none were merged. Three new pull requests show some activity, but the lack of completed work suggests limited maintenance throughput.

Security policycaution

The repository has no security policy, which makes vulnerability-reporting expectations less transparent. CodeQL scanning provides some compensation, but it does not replace a policy.

Workflow auditcaution

All 19 analyzed action references are unpinned, and the audit found two high-confidence template-injection findings in the Dependabot workflow. The workflow has no pull_request_target or workflow_run trigger, so these findings are workflow hygiene concerns rather than a severe trigger-and-sink combination.