mri

Maintainerscaution

Only one registry account has publish access, creating a thin publishing base. The matching repository and established release history provide some compensation, but do not remove the continuity risk.

Release historycaution

The package has 10 releases since April 2017, but its latest registry release was in September 2021 and there were no releases in the last 12 months. This is a meaningful maintenance concern for a dependency, though the package appears mature and stable.

Repo commit activitycaution

The repository had no commits and no active maintainers during the last three months. That indicates currently limited maintenance capacity, even though the repository was pushed in March 2024.

Security policycaution

The linked repository has no security policy. This is a transparency and vulnerability-reporting gap, though it is less significant for a small, focused CLI argument parser.

Workflow auditcaution

The sole workflow was fully analyzed with no high- or medium-severity findings and no dangerous triggers or untrusted checkouts. However, both action references are unpinned, leaving a modest workflow supply-chain hygiene gap.