@vue/server-renderer

Repo package mentioncaution

The repository name does not match the package name and its README does not mention this package, creating a package-to-repository transparency concern. The organization-owned monorepo context makes a subpackage layout plausible, but the collected signal does not explicitly establish that mapping.

Repo toolingcaution

The project uses established build, test, and compilation tooling, supporting a mature build process; no automated security scanning was detected, which is a modest transparency gap but not severe given the other controls.

Token permissionscaution

Four workflows declare read-only permissions, but the release workflow lacks top-level permissions and four workflows request top-level write access; this leaves some workflow privilege configuration less explicit than ideal.