Contributing

Please open an issue before a large change. Keep parsing bounded, deterministic and independent of network services. Treat every package field as untrusted; never execute embedded code or inject package markup into the document.

Run npm run check and npm run test:browser before proposing a change. New adapters need malformed, limit and missing-reference fixtures as well as normal fixtures. Contributions are accepted under GPL-3.0-or-later.