lodash

Build provenancecaution

No registry build attestation or trusted-publisher provenance is present, leaving the publication path less transparent than an attested release. Repository build and security tooling provide partial compensation but do not remove this gap.

Token permissionscaution

Six of eight workflows lack top-level permission declarations, which weakens explicit least-privilege documentation even though none declares top-level write access and two specify read-only permissions.

Type declarationscaution

No type declarations are bundled, which can reduce integration ergonomics for TypeScript consumers, though it does not indicate abandonment or unfitness for JavaScript use.