openapi-path-templating

Build provenancecaution

No build attestation or trusted-publisher provenance is reported, leaving publication origin less verifiable than it could be.

Release historycaution

The package has 20 releases, but none in the last 12 months and its latest release was about 18 months ago. That slowdown raises maintenance risk, though the project is not otherwise shown to be abandoned.

Repo commit activitycaution

There were no commits or active maintainers in the last three months, indicating a recent maintenance pause even though the repository was pushed earlier in the year.

Repo issue activitycaution

There were no new or closed issues or pull requests in the last month, and five issues plus six pull requests remain open. This supports the broader indication of limited recent maintenance.

Workflow auditcaution

All four workflows were analyzed, but all 10 action references are unpinned and a high-confidence bot-conditions finding affects the Dependabot merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, so this is a hygiene and workflow-integrity concern rather than a severe standalone risk.