y-prosemirror

Release historycaution

The package has 84 releases since April 2019, but none in the last 12 months and the latest release was about 14 months ago. Recent repository activity partly offsets the quiet registry cadence.

Repo bus factorcaution

One contributor made 22 of 23 recent commits, creating concentration risk. Organization ownership and a second active contributor partly compensate, but the contribution base remains narrow.

Repo toolingcaution

The project uses TypeScript and Rollup, showing an established build process, but no security-scanning tooling was detected.

Security policycaution

The repository has no security policy, which reduces transparency for reporting and handling vulnerabilities.

Workflow auditcaution

All three workflows were analyzed without dangerous sinks or audit findings, and one scopes permissions at job level. However, all eight action references are unpinned, leaving avoidable reproducibility and action-update risk.