web-tree-sitter

Maintainerscaution

Eight accounts can publish, but five use consumer email addresses and one uses dcreager.net; alongside the organization-backed repository, this is an account-hygiene caution rather than evidence of weak maintenance capacity.

Repo package mentioncaution

The repository name does not match web-tree-sitter and its README does not mention the package, so the linkage is less transparent; the mismatch may reflect a monorepo sub-package, but the absent README mention remains a caution.

Security policycaution

No repository security policy was found, leaving disclosure and handling expectations less transparent.

Version stabilitycaution

Version 0.27.1 is not a stable major release, but it is not prerelease and recent releases contain no prerelease share, so this is a modest maturity limitation rather than a major concern.

Workflow auditcaution

All 51 analyzed action references are unpinned, and a high-confidence finding reports blanket GitHub App installation permissions in backport.yml. The cache-poisoning findings are low confidence and remain hygiene concerns; pull_request_target triggers had no reported untrusted checkout or script-injection sink.