whatwg-url-minimum

Repo bus factorcaution

All 12 recent commits came from one contributor, creating a real continuity risk. Organization ownership provides some maintenance capacity, but no second active contributor is shown.

Repo toolingcaution

The project uses TypeScript, Vitest, Rollup, npm scripts, and Babel, indicating a structured build and test setup. No security-scanning tool was detected, leaving a modest hygiene gap.

Security policycaution

The repository has no security policy, so it does not clearly document how consumers should report vulnerabilities or receive security guidance.

Version stabilitycaution

Version 0.2.0 is not a prerelease, but 61.5% of recent releases were prereleases and the package remains below 1.0. Consumers should expect a less-established compatibility promise.

Workflow auditcaution

Both workflows were analyzed without failures and have no untrusted triggers or script-injection findings; one workflow scopes permissions at job level. However, all 10 action references are unpinned, and the release workflow installs a package outside a lockfile, creating workflow reproducibility and supply-chain hygiene concerns.