w3c-xmlserializer

Repo commit activitycaution

There were zero commits and zero active maintainers in the last 3 months. The current release and recent pull-request activity partly offset this, but the recent direct maintenance gap remains a caution.

Repo toolingcaution

No build tool or security scanning tool was detected. The absence of security scanning is a transparency and hygiene gap, although the package is small and the repository has other maintenance evidence.

Type declarationscaution

No type declarations are included, which is a minor integration gap for TypeScript consumers but does not indicate maintenance or abandonment risk for this JavaScript serializer.

Workflow auditcaution

All four analyzed action references are unpinned and one workflow grants top-level write permissions, creating reproducibility and token-scope concerns. The only cache-poisoning finding has low confidence, so it is hygiene rather than a severe risk.