locate-path

Release historycaution

The project is mature, with releases since November 2016, but it has made no registry release in the past 12 months. That is a maintenance concern, though the latest release is still recent enough to remain usable.

Repo commit activitycaution

No commits or active maintainers were recorded in the past 3 months. The recent repository push is a compensating sign, but the measured development activity remains thin.

Repo toolingcaution

The repository reports no build tool and no security scanning tool. This is a modest transparency and maintenance gap for a small package, not evidence of abandonment by itself.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkouts, injection findings, or auditor-reported vulnerabilities. However, both action references are unpinned, leaving them exposed to upstream changes.