jest-resolve-dependencies

Build provenancecaution

This release has no build attestation or trusted-publisher metadata, leaving its artifact-to-source build trail less transparent despite the active repository.

Repo package mentioncaution

The linked repository neither matches the package name nor mentions it in the README, so package ownership is less explicit; the Jest organization backing partly offsets this concern.

Workflow auditcaution

All 11 workflows were analyzed, all 48 action references are pinned, and no untrusted checkout or script-injection paths were found. The audit nevertheless flags high-confidence use of long-lived registry publishing credentials, which is a supply-chain hygiene concern.