sonner

Build provenancecaution

The release has no build attestation, trusted publisher identity, or staged publishing record, leaving publication provenance less transparent than it could be.

Project backingcaution

The repository is owned by a named individual rather than an organization, so maintenance continuity depends heavily on that owner and the broader contributor community.

Repo bus factorcaution

All three recent commits came from one contributor, creating a meaningful single-maintainer continuity risk. The repository is user-owned rather than organization-owned, so there is no organizational backing shown to offset that concentration.

Repo issue activitycaution

The repository still receives pull requests, but none were merged in the last month while 37 issues and 39 pull requests remain open, indicating some backlog.

Repo toolingcaution

The repository uses TypeScript, Turbo, and npm scripts for builds, but no security scanning tools were detected, leaving security-process coverage limited.