alazzi-az/odoo-xmlrpc

Release historycaution

The latest registry release was published nearly two years ago, and there were no releases in the last 12 months. This is meaningful staleness for a library dependency, although the repository was pushed more recently.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. That weakens evidence of ongoing maintenance despite the repository not being archived.

Security policycaution

The repository has no security policy, leaving no documented channel or process for reporting vulnerabilities. This is a transparency gap, though it is partly offset by the repository's visible tests and build workflow.

Workflow auditcaution

All seven analyzed action references are unpinned, and the audit found a high-confidence template-injection issue in the code-style workflow plus an archived action in the release workflow. No untrusted checkout or dangerous trigger was reported, so these are hygiene and supply-chain concerns rather than a standalone disqualifier.