precinct

Build provenancecaution

No build attestation or trusted-publisher provenance is present. This limits publication transparency, but it is a verification gap rather than evidence that the release is unsafe or abandoned.

Dependency profilecaution

The release has 15 runtime dependencies, including multiple detector packages and parsers. This is a meaningful dependency surface, but it is coherent with the package's broad language and stylesheet support.

Repo bus factorcaution

One contributor made 100% of recent commits. Organization ownership provides some ability to hand off maintenance, but no second recent contributor is visible in this signal.

Repo commit activitycaution

Seven commits were made in the last three months, showing recent activity. However, all of them came from one active maintainer, limiting evidence of distributed maintenance capacity.

Security policycaution

The repository has no published security policy. This is a transparency gap for reporting and handling vulnerabilities, though it does not by itself indicate abandonment.