libqp

Repo commit activitycaution

There were no commits or active maintainers in the last three months, which is a maintenance concern. The same period includes a current release and a repository push, so this is a modest caution rather than abandonment evidence.

Repo toolingcaution

The repository reports no build tool and no security scanning tools. That is a build and maintenance-hygiene gap, although the package is small and has tests.

Security policycaution

No security policy is present in the repository, reducing transparency about vulnerability reporting and response.

Type declarationscaution

No type declarations are included, which is a minor integration limitation for consumers using TypeScript, but it does not indicate abandonment or supply-chain risk.

Workflow auditcaution

Both workflows were fully audited with no dangerous findings or untrusted checkouts, but all five action references are unpinned and one workflow grants top-level write permissions. These are workflow-hygiene weaknesses, not severe risks on their own.