@volar/language-service

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving publication origin less transparent despite the package's otherwise established release history.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last 3 months, a meaningful maintenance warning that is partly offset by the package's recent release history and non-archived repository.

Repo toolingcaution

The project uses TypeScript, Vitest, and npm build tooling, but no security scanning tools were detected; this is a modest repository-hygiene gap rather than evidence of abandonment.

Security policycaution

No repository security policy was found, reducing transparency for vulnerability reporting and response expectations.

Workflow auditcaution

All 11 analyzed action references are unpinned, and one high-confidence medium-severity finding uses an archived action; there are no untrusted checkouts, injection findings, or broad top-level write permissions.