alpdesk/alpdesk-core

Dependency profilecaution

The package declares 28 runtime dependencies, including substantial framework and security components. This adds maintenance surface and upgrade coordination, but the signal does not show an inherently unsafe dependency profile.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers during the last 3 months, a meaningful sign of slowed maintenance despite the recent registry release.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving a repository-level transparency and vulnerability-monitoring gap.

Security policycaution

The repository has no SECURITY.md or other detected security policy, making vulnerability reporting and handling less transparent.

Workflow auditcaution

The sole workflow was fully analyzed with no reported dangerous findings, but all 5 action references are unpinned. The absence of a top-level permissions block is acceptable on its own and does not offset the reproducibility risk.