conventional-changelog-jquery

Registry deprecationdanger

The entire package is marked deprecated, and the registry message directs users to conventional-changelog-conventionalcommits or conventional-changelog-angular. This is a release-selection risk even though the source repository remains active.

Build provenancecaution

No build attestation or trusted-publisher provenance was observed, leaving publication origin less verifiable. This is a transparency gap rather than evidence of maliciousness.

Release historycaution

The package has existed for about 11 years with 32 releases, but only one release occurred in the last 12 months. That slower cadence is partly consistent with its deprecated status.

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, so package-to-repository ownership is less directly established. The organization-owned monorepo context partly explains the mismatch but does not remove the ambiguity.

Security policycaution

The repository has no security policy. That reduces vulnerability-reporting transparency, although it is less important than the package's explicit deprecation.