@vue/tsconfig

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last 3 months. The recent release partly offsets this because a configuration package may need few changes, but the current maintenance activity is still a caution.

Repo toolingcaution

The project uses TypeScript and Vite, but no security scanning tooling was detected. This is a modest transparency and maintenance gap rather than a severe dependency risk.

Security policycaution

No security policy was found in the linked repository, leaving the process for reporting and handling vulnerabilities undocumented.

Workflow auditcaution

All workflows were analyzed and have job-level permission scoping, with no untrusted checkout or script-injection paths. However, both action references are unpinned and the publish workflow installs a package outside a lockfile; the cache-poisoning alert is low confidence and is hygiene only.