@vue/shared

Repo package mentioncaution

The linked repository name does not match @vue/shared and its README does not mention the package, creating a transparency caveat. However, the repository is the organization-backed Vue core monorepo, so this mismatch is consistent with a subpackage layout.

Repo toolingcaution

The repository uses established build and test tooling, including TypeScript, Rollup, Vitest, Vite, and related compilers; no security scanning tools were detected, which is a minor process gap.

Token permissionscaution

Most workflows declare read-only or scoped permissions, but the release workflow lacks top-level permissions and four workflows request top-level write access, leaving some CI permission-hardening concerns.