spdx-correct

Release historycaution

The package has 18 releases over more than 11 years, but none in the last three years; that indicates a mature package with currently limited release activity.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months, which weakens evidence of ongoing maintenance, although the repository is not archived.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting and response expectations unclear; this is a transparency gap rather than evidence of unsafe code.

Workflow auditcaution

The workflow audit completed without security findings or untrusted execution paths. Both referenced actions are unpinned, which is a modest reproducibility and supply-chain hygiene gap.