@messageformat/runtime

Build provenancecaution

No build attestation or trusted-publisher provenance is provided, leaving publication origin less transparent, though this is not by itself a maintenance failure.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, a meaningful sign that maintenance may be slowing.

Repo issue activitycaution

There were no new or closed issues or pull requests in the last month, suggesting limited recent maintenance activity, though the repository still has open work.

Workflow auditcaution

All three workflows were analyzed, but all 13 action references are unpinned, one workflow grants top-level write permissions, and a high-confidence finding shows installation outside a lockfile. These are workflow hygiene concerns rather than evidence of an unsafe release path.