@tanstack/router-plugin

Repo package mentioncaution

The package is hosted in an organization-owned monorepo, but the repository name does not match the package and its README does not mention it. That makes package-to-repository ownership less transparent, though the monorepo context partly explains the mismatch.

Security policycaution

No repository security policy was found. This is a transparency gap for reporting vulnerabilities, though the available security scanning and active maintenance partly offset it.

Workflow auditcaution

All 9 workflows were analyzed successfully, all 33 action references are pinned, and six workflows use read-only permissions. Three high-confidence low-severity adhoc-package findings and three workflows with top-level write permissions are minor hygiene concerns.