adaa/shipping

Release historycaution

The package is less than 1 day old and has only two releases, so its maintenance record and compatibility history are still unproven. Recent publishing is a positive counter-signal, but it cannot establish long-term stability.

Repo commit activitycaution

No commits or active maintainers were recorded in the prior 3 months, but the repository itself is less than 1 day old and was recently pushed. The result is limited evidence rather than demonstrated abandonment.

Security policycaution

The repository has no security policy, leaving disclosure and response expectations undocumented. This is a transparency gap for a library that integrates with external shipping services.

Version stabilitycaution

Version v0.2.0 is not a stable major release, which indicates that consumers may face API changes. It is not marked as a prerelease, so this is a moderate maturity concern rather than a severe warning.

Workflow auditcaution

Both workflows were analyzed without audit findings or untrusted-trigger sinks, but all four action references are unpinned and the release workflow grants top-level write access. These are workflow reproducibility and permission-hygiene concerns, not severe risks on their own.