asgrim/mini-mezzio

Release historycaution

The package has existed for over 6 years but has only 8 releases, with a median interval of about 13 months and one release in the last 12 months. The recent release shows the project is not abandoned, but maintenance is infrequent.

Repo commit activitycaution

There were no commits and no active maintainers in the last 3 months. Although a release was published recently, the lack of recent commit activity limits evidence of ongoing maintenance.

Security policycaution

No repository security policy was found. This is a transparency gap, though the presence of Dependabot provides some compensating security tooling.

Workflow auditcaution

All 15 analyzed action references are unpinned, and the audit found a high-confidence bot-condition issue in a pull_request_target workflow; that workflow also has top-level write permissions. No untrusted checkout or script injection was found, so this is a meaningful hygiene caution rather than a severe dependency verdict.