unload

Build provenancecaution

The release has no build attestation or trusted-publisher provenance, so consumers have less assurance about how the published artifact was produced.

Release historycaution

The latest release was in December 2022, with no releases in the following 12 months; this is a meaningful freshness and abandonment concern for a dependency.

Repo commit activitycaution

There were no commits or active maintainers in the last 3 months, although five pull requests were merged in that period, which partly offsets the maintenance concern.

Security policycaution

No security policy was found, reducing transparency for vulnerability reporting, though this is a hygiene gap rather than evidence that the package is unsafe.

Workflow auditcaution

The audit covered both workflows and found no dangerous triggers or findings, but one file failed analysis and three of four action references were unpinned, leaving reproducibility and audit coverage gaps.