orval

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving the published artifact's build origin less independently verifiable.

Dependency profilecaution

The release has 25 runtime dependencies, including multiple related Orval packages and parser tooling; this is a substantial dependency surface but fits a feature-rich code generator.

Workflow auditcaution

All 23 analyzed action references are unpinned, and high-confidence template-injection findings plus trusted-publishing findings affect release workflows. The low-confidence cache-poisoning finding is hygiene only; no untrusted checkout or script-injection sink was found.