vfile-sort

Build provenancecaution

No build attestation or trusted-publisher identity is recorded, leaving publication provenance less transparent. This is a supply-chain hygiene gap, not evidence that the release is unsafe.

Release historycaution

The package has 12 releases over about 11 years, but none in the last three years and the latest release was in June 2023. This is a meaningful maintenance concern, although the package is mature and stable.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months, consistent with the roughly three-year release gap. A stable utility can need few changes, but this still lowers confidence in ongoing maintenance.

Repo toolingcaution

The repository uses TypeScript and npm build tooling, but no security-scanning tools were detected. The missing scanner is a hygiene limitation rather than a severe risk by itself.

Workflow auditcaution

Both workflows were analyzed successfully with no audit findings, and the pull_request_target workflow has no untrusted checkout or script-injection sink. However, all four action references are unpinned, so workflow dependencies remain mutable.