gridprinciples/blade-forms

Dangerous workflowscaution

One workflow uses pull_request_target for Dependabot auto-merge, which warrants review because that trigger can expose elevated workflow privileges, although no untrusted checkout or script injection was detected.

Release historycaution

The project has existed for over 11 years with six releases, but it has made no registry release in about 16 months. That slows confidence in compatibility, despite the long project history.

Security policycaution

The repository has no published security policy, reducing transparency for reporting and handling vulnerabilities, though this is a hygiene gap rather than evidence of abandonment.

Token permissionscaution

Three of four workflows declare top-level write permissions and one lacks top-level permissions entirely, leaving workflow privileges broader or less explicit than ideal.

Version stabilitycaution

Version v0.3.0 is not a prerelease, but it remains below a stable major version, so its API and compatibility guarantees may be limited.