gember/event-sourcing-universal-service-provider

Dependency profilecaution

The package declares 16 runtime dependencies, including several framework, database, messaging, and serialization adapters. That broad integration surface increases upgrade coordination, though it is consistent with the package's service-provider role.

Release historycaution

The package is 511 days old with 12 releases and a latest release on 2026-08-24; only two releases occurred in the last 12 months, suggesting slower recent delivery but not abandonment.

Security policycaution

No repository security policy was found, so users have no documented vulnerability-reporting path. This is a transparency gap for a package intended for application integration.

Version stabilitycaution

Version 0.11.0 is not a stable major release, so compatibility may still change before 1.0. It is not marked as a prerelease, which partly offsets that concern.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkouts, script injection, or audit findings, and it avoids top-level write permissions. However, both of its two action references are unpinned, leaving them exposed to upstream changes.