@huggingface/jinja

@huggingface/jinja 0.5.10 appears to be a healthy dependency: it has a sustained release history over nearly 3 years, recent releases, active development in an organization-owned repository, broad contributor participation, build provenance, and a small runtime dependency surface. The artifact is licensed, typed, and includes source files, while repository tests compensate for the absence of packaged tests. The main reservations are the lack of a security policy and incomplete or broadly write-enabled workflow permission declarations, but the workflows show no analyzed pull-request-target, untrusted-checkout, or script-injection patterns, and repository security scanning is enabled. The package is not deprecated or archived and is reasonable to adopt, subject to normal review of future releases.

Latest 0.5.10NPM

Health Score Breakdown

Security policycaution

No repository security policy was found, which weakens vulnerability-reporting transparency and is a genuine hygiene gap, although other security controls are present.

Token permissionscaution

Six workflows lack top-level permissions and 17 declare top-level write permissions, indicating weaker least-privilege workflow hygiene; this is partly mitigated by the absence of dangerous workflow patterns and the repository's security scanning.

Version stabilitycaution

Version 0.5.10 is not a stable-major release, but it is not prerelease and recent prerelease share is 0%, so the versioning status is a modest maturity limitation rather than a major concern.

View all 21 health checks

Vulnerabilities

We didn't find any vulnerabilities for this package.

Maintainers

julien-c

pierric

coyotte508

xenova

gary149