rc9

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing is recorded, leaving the relationship between source and published artifact less transparent.

Repo commit activitycaution

The repository records 0 commits and 0 active maintainers over the last 3 months, a meaningful maintenance-activity concern. Recent releases and merged pull requests provide some compensating evidence, but do not eliminate the unusually quiet commit signal.

Repo toolingcaution

TypeScript and Vitest build tooling are present, but no security-scanning tools are configured, leaving a security-hygiene gap.

Security policycaution

The repository has no security policy, reducing disclosure and vulnerability-response transparency.

Token permissionscaution

No workflow requests top-level write permissions, but one workflow lacks a top-level permissions declaration, so least-privilege intent is not fully explicit.