resolve-dependency-path

Build provenancecaution

No registry build attestation or trusted-publisher provenance is available, leaving publication origin less independently verifiable even though other repository evidence is present.

Release historycaution

The package has existed for over 11 years and has a release as recent as May 2026, but only nine releases overall and one in the last year indicate a deliberately slow cadence rather than rapid ongoing development.

Repo bus factorcaution

All recent commits came from one contributor, creating a meaningful continuity risk; organizational ownership partly compensates because maintenance can potentially be handed off within the organization.

Repo commit activitycaution

Two commits were made in the last three months, showing recent activity, but only one active maintainer contributed them, so ongoing maintenance capacity is limited.

Security policycaution

No SECURITY.md or equivalent security policy was found, so vulnerability reporting expectations are less transparent for consumers.