graphlib

Release historycaution

The latest registry release was nearly seven years ago, with no releases in the last 12 months. Active repository commits partly offset abandonment concerns, but the published release is stale.

Repo toolingcaution

The project uses Make, TypeScript, npm scripts, and esbuild, showing an established build process. No security scanning tools were detected, leaving a minor hygiene gap.

Security policycaution

The repository has no security policy, reducing transparency around vulnerability reporting and response.

Type declarationscaution

The published artifact contains no type declarations, which is a real integration gap for TypeScript consumers; repository type files do not compensate for their absence from this release.

Workflow auditcaution

The single workflow was fully analyzed with no reported findings or untrusted checkout paths. Both action references are unpinned, which weakens build reproducibility, while the lack of a top-level permissions block is not harmful on its own.