jest-image-snapshot

Release historycaution

The package has a long history with 49 releases, but only one release in the last 12 months. The recent 6.5.2 release provides some evidence of continued maintenance, making this a mild concern rather than abandonment.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers over the last three months, despite being pushed recently and having a long release history. This indicates currently limited observed development activity.

Repo toolingcaution

The repository reports no build tooling and no security scanning tools. This is a transparency and maintenance-hygiene gap, though it is partly offset by the available tests and release provenance.

Security policycaution

No repository security policy was found, leaving vulnerability reporting and response expectations undocumented. The organization-owned repository and other project documentation provide some compensating context, but not a complete substitute.

Workflow auditcaution

All 8 analyzed action references are unpinned, which weakens build reproducibility. The audit also found a high-confidence template-injection issue in release.yml and one script-injection finding, but the reported trigger is in a different workflow, so these are workflow hygiene concerns rather than severe evidence on their own.