@vue/compiler-ssr

Repo package mentioncaution

The linked repository name does not match the package and its README does not mention @vue/compiler-ssr, so package ownership is less transparent. The monorepo structure makes a name mismatch ordinary, but the lack of an explicit mention remains a caution.

Workflow auditcaution

All 8 workflows were analyzed and all 40 action references are pinned, but the audit found a high-confidence template-injection issue and a high-confidence ad hoc package installation. The low-confidence cache findings are hygiene concerns only, while top-level write permissions are not dangerous without an untrusted sink.