@vue/reactivity

Repo package mentioncaution

The repository name does not match @vue/reactivity and its README does not mention the package, so the package-to-repository link is less transparent; the monorepo context makes a name mismatch ordinary but does not remove this caution.

Repo toolingcaution

The project uses established build and test tooling and has an active build pipeline. No security-scanning tool was detected, which is a modest hygiene gap, but the repository does provide a security policy.

Workflow auditcaution

All 8 workflows were analyzed and all 40 action references are pinned, with no untrusted checkouts or script-injection findings. A high-confidence template-injection finding and a high-confidence ad hoc package installation warrant workflow hygiene caution; the low-confidence cache findings carry little weight.