parse5-parser-stream

Project backingcaution

The repository is owned by an individual user rather than an organization, so the single-contributor and bus-factor concerns are not mitigated by explicit organizational backing.

Release historycaution

The package is mature, with 8 releases over roughly 8 years, but it had no releases in the last 12 months despite its latest release being in July 2025. This lowers confidence in release cadence.

Repo bus factorcaution

One contributor made 100% of recent commits, creating a concentrated maintenance dependency without provided organizational backing to offset it.

Repo commit activitycaution

Six commits were made in the last 3 months, but all came from one active maintainer. The commits show activity, while the narrow recent contributor base adds maintenance risk.

Workflow auditcaution

All four workflows were analyzed and all 12 action references are pinned, with no untrusted checkout or script-injection findings. However, a high-confidence bot-conditions finding affects the Dependabot automerge workflow, and one workflow grants top-level write permissions.