conventional-recommended-bump

Build provenancecaution

No build attestation or trusted-publisher identity was provided, so consumers have less evidence connecting the published artifact to its source build.

Repo bus factorcaution

One contributor made about 91% of recent commits. The organization-owned project and five other active contributors partly compensate, but the recent work remains highly concentrated.

Repo toolingcaution

The project uses TypeScript, Vite, and npm scripts for builds, but no security-scanning tools were detected; this is a modest transparency gap.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting expectations undocumented.

Workflow auditcaution

All five workflows were analyzed without dangerous sinks or audit findings, but all 37 action references are unpinned and one workflow grants top-level write access. These are workflow hygiene concerns, not severe risks on their own.