xdg-basedir

Release historycaution

The latest registry release was about five years ago, with no releases in the last 12 months. Recent repository activity partly offsets the age, but the published release cadence remains a maintenance concern.

Repo bus factorcaution

All recent commit activity came from one contributor, leaving maintenance dependent on a single person and increasing continuity risk.

Workflow auditcaution

The only workflow was fully analyzed and has no untrusted checkouts, injection findings, or excessive top-level permissions, but both of its two action references are unpinned.