tinyqueue

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is reported. This is a transparency and release-integrity gap, although it is not by itself evidence that the release is unsafe.

Maintainerscaution

Only one registry account has publish access. The matching repository is also owned by a user rather than an organization, so publishing and maintenance capacity are concentrated.

Project backingcaution

The repository owner is the individual user mourner rather than an organization, so there is no organizational backing to offset the concentrated maintainer base.

Release historycaution

The package has existed for over 11 years with 12 releases, but it has had no release in the last two years. This suggests slowing maintenance, though the stable 3.0.0 release and small scope may reduce the practical impact.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months, which weakens evidence of ongoing maintenance.