jsdom

Dependency profilecaution

Twenty runtime dependencies create meaningful update and transitive-risk surface, but the dependencies are explicitly declared and appropriate to this standards-focused library.

Workflow auditcaution

Both workflows were analyzed without failures, but all 8 action references are unpinned, one workflow grants top-level write access, and a high-confidence low-severity audit found an ad hoc package install. The cache-poisoning finding is low confidence and therefore only a minor hygiene concern.