neos/flow-development-collection

Dependency profilecaution

The package declares 33 runtime dependencies, including several framework and database components. This is a substantial dependency surface, but the provided project and tooling signals show an actively maintained framework package.

Workflow auditcaution

All four workflows were analyzed, but all 16 action references are unpinned and the audit found four high-confidence template-injection findings plus one archived action. The pull_request_target trigger has no untrusted checkout or script-injection count, so it is not independently dangerous here, but the workflow hygiene remains a real concern.