conventional-changelog-jshint

Registry deprecationdanger

The entire package is deprecated, and the registry explicitly directs users to conventional-changelog-conventionalcommits or conventional-changelog-angular. This is a direct maintenance and adoption warning for version 5.2.0.

Repo package mentioncaution

The repository name does not match this package and its README does not mention it. Although a monorepo mismatch can be normal, the absence of a package mention makes ownership less transparent.

Security policycaution

The linked repository has no security policy, leaving reporting and response expectations undocumented. This is a transparency gap, but the active organization-backed project provides some compensation.

Workflow auditcaution

All 37 analyzed action references are unpinned, which weakens build reproducibility. No untrusted checkouts, script injections, or audit findings were detected, and the single workflow with top-level write permissions has no corroborating untrusted trigger.