conventional-changelog-core

Registry deprecationdanger

The entire package is deprecated with an explicit message saying it is no longer maintained and directing users to conventional-changelog. This is a severe adoption risk for a dependency.

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving publication origin less transparent. This is a secondary concern beside the package-level deprecation.

Release historycaution

The package has 69 releases over more than 10 years, but no releases in the last 12 months; the latest release was about 19 months ago. The active repository partly offsets this, but the published package cadence is stale.

Repo package mentioncaution

The repository name does not match this package and its README does not mention the package, so the package-to-repository relationship is less transparent even though it appears within a related monorepo.

Security policycaution

The repository has no security policy, which weakens vulnerability-reporting transparency. The active project and clear license provide some compensating maturity evidence, but not a security contact path.