merge2

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving the publication process less transparent, though this is a secondary concern for a small package.

Maintainerscaution

Only one registry publishing account is listed, which is a narrow publishing base; the organization-backed repository provides some compensating ownership context.

Release historycaution

The package has 23 releases since October 2014, but its latest release was about 6 years ago and there were no releases in the last 12 months, indicating stalled release maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last 3 months, weakening evidence of active maintenance even though it remains available.

Repo issue activitycaution

There were no new or closed issues or pull requests in the last month, while five pull requests remain open, suggesting limited recent project activity.