@mermaid-js/parser

Repo package mentioncaution

The repository name differs from the package name and its README does not mention this package, creating some uncertainty about the package-to-repository mapping. The organization-owned monorepo context partly offsets that concern, but the signal remains a caution.

Workflow auditcaution

All 23 workflows were analyzed with no failed files; 16 use read-only permissions and all 86 action references are pinned. High-confidence findings include inherited secrets and two ad hoc package installs, while the cache findings are low-confidence; these are workflow-hygiene cautions rather than evidence of an unsafe release.