always-open/bwt-api

Release historycaution

The package has six releases over about nine months, but the latest release was about six months before collection. That suggests maintenance may have slowed after an initially active period.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the past three months. This is concrete evidence of currently quiet maintenance, despite the recent release history.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. The missing scanning is a hygiene gap rather than evidence of abandonment.

Version stabilitycaution

This is a non-prerelease v0.0.6 release, but the pre-1.0 version still indicates an immature compatibility commitment.

Workflow auditcaution

All 10 analyzed action references are unpinned, and the audit found one high-confidence bot-condition issue in the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, so this remains a workflow-hygiene concern rather than a severe risk.