dependency-cruiser

Repo bus factorcaution

One contributor made 50 of 53 recent commits, leaving the project operationally dependent on a single primary developer. Three additional contributors were active, which partially offsets but does not remove the concentration risk.

Workflow auditcaution

All five workflows were analyzed with no untrusted checkout or script-injection findings, and most workflows scope permissions at job level. However, 13 of 14 action references are unpinned, and a high-severity cache-poisoning pattern was reported with low confidence plus a high-confidence adhoc-package install; these are workflow hygiene concerns rather than evidence of an unsafe release on their own.