conventional-changelog-config-spec

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less transparent. This is a supply-chain transparency gap rather than evidence that the release is unsafe.

Maintainerscaution

A single registry publishing account is a limited publishing base, but the repository is owned by an organization, which provides some compensating project backing.

Release historycaution

The package has only three releases, with the latest published in August 2019 and none in the last 12 months. This is a meaningful maintenance concern, although the repository remains available and was recently pushed.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers over the last three months. That weakens confidence in ongoing maintenance despite the recent push timestamp.

Repo issue activitycaution

There were no new or closed issues in the last month, and one pull request was opened without a merge. This suggests limited visible project throughput.