truncate-utf8-bytes

Build provenancecaution

No registry build attestation or trusted-publisher provenance is available, which limits publication transparency. This is a supply-chain hygiene gap but not evidence that the package is unsafe by itself.

Project backingcaution

The repository is owned by an individual rather than an organization, so the small maintainer base offers limited redundancy. This matters more given the lack of recent activity.

Release historycaution

The package has only three releases, with the latest published nearly 10 years ago and none in the last 12 months. That is a meaningful maintenance concern, although a small stable utility may not need frequent releases.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months, indicating that maintenance has currently stalled. The repository's non-archived state and 2023 push provide only partial compensation.

Repo issue activitycaution

There were no new or closed issues or pull requests in the last month, with only two open issues and one open pull request. This suggests limited current responsiveness.