lodash._createset

Release historycaution

The package has had no registry release for about 10 years, with zero releases in the last 12 months. Its four-release history is stable but indicates this package is effectively frozen.

Repo package mentioncaution

The repository name does not match this package and its README does not mention lodash._createset. A name mismatch can be normal for a monorepo sub-package, but the lack of any package mention leaves ownership less transparent.

Token permissionscaution

Six of eight workflows lack top-level token permissions declarations, which is a workflow-hardening gap. However, none declares top-level write access and two explicitly use read-only permissions.