cbor

Package scaffoldingcaution

The package includes a substantial README and release notes for this version, while its repository has tests. However, the README says maintenance, support, and new features have moved to cbor2, with only catastrophic bugs expected here.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last 3 months, indicating little current development activity. This is consistent with the project’s stated maintenance transition.

Repo toolingcaution

The repository uses established build tooling, but no security-scanning tools were detected. This modestly limits automated maintenance assurance.

Security policycaution

The repository has no security policy, leaving reporting and response expectations undocumented. This is a transparency gap, though it does not by itself indicate abandonment.

Workflow auditcaution

Both workflows were analyzed with no untrusted checkout or script-injection paths, and one scopes permissions at job level. However, all 8 action references are unpinned, and a low-confidence cache-poisoning finding remains hygiene debt.