merge-descriptors

Release historycaution

The package has seven releases over about 13 years, but none in the last three years. That is consistent with a small, stable utility, yet it limits evidence of current maintenance.

Repo commit activitycaution

No commits or active maintainers were recorded in the last three months. For a small mature utility this may reflect stability, but it weakens evidence that issues will be addressed promptly.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, both action references are unpinned, which is a modest supply-chain reproducibility gap.