bctls-jdk15on

Licensecaution

The registry declares the Bouncy Castle Licence, while the repository detector identified MIT; the mismatch should be clarified even though the repository contains a license file.

Release historycaution

The package has had no registry release in nearly five years, despite the linked repository being actively updated. This creates meaningful version-staleness and support risk for adopting 1.70.

Repo package mentioncaution

The repository name does not match this package and its README does not mention it. That is a caution because the linkage is not directly confirmed, although the organization backing and package namespace provide context.

Workflow auditcaution

The workflow audit completed fully with no injection or high-severity findings, but all three action references are unpinned, leaving avoidable workflow supply-chain exposure.