tree-sitter

Repo bus factorcaution

All recent commits came from one contributor, creating a concentrated maintenance risk; organization ownership provides some ability to hand maintenance off.

Repo commit activitycaution

The repository recorded only 1 commit in the last 3 months, with 1 active maintainer, which is a meaningful sign of slowing maintenance for a mature package.

Security policycaution

The linked repository has no security policy, leaving vulnerability reporting and response expectations less transparent.

Workflow auditcaution

All 11 analyzed action references are unpinned, and one workflow has top-level write permissions. The only audit finding is low-confidence cache-poisoning hygiene, with no untrusted checkout or script injection detected.