conventional-changelog-express

Registry deprecationdanger

The entire package is deprecated, with the publisher directing users to conventional-changelog-conventionalcommits or conventional-changelog-angular. This directly makes the release unsuitable for a new dependency despite the active repository.

Build provenancecaution

No build provenance attestation or trusted-publisher metadata was detected. This limits publication transparency, though it does not by itself establish that the release is unsafe.

Release historycaution

The package has existed for about 10 years with 20 releases, but only one release in the last 12 months. This shows maturity but limited release activity for the package itself.

Repo bus factorcaution

One contributor made about 91% of recent commits, which creates concentration risk. The organization-owned repository and five other recent contributors partly compensate, so this is a moderate concern rather than a severe abandonment signal.

Repo package mentioncaution

The repository name does not match the package and its README does not mention this package, so ownership of the published subpackage is less transparent. The organization-owned monorepo context makes a subpackage mismatch plausible, but does not remove the ambiguity.