tr46

Repo commit activitycaution

There were no commits or active maintainers in the last three months, which is a maintenance concern. Recent release activity and four merged pull requests in the last month partly offset that signal.

Workflow auditcaution

All four analyzed action references are unpinned, and the publish workflow has top-level write permissions, creating avoidable workflow supply-chain exposure. The reported cache-poisoning finding is low confidence and does not involve an untrusted trigger, so it is not treated as a severe risk.