atk4/filestore

Release historycaution

The package has five releases since November 2018, but none in the 12 months before the assessment and the latest release was in March 2024. This indicates slow maintenance for a library with a long history, though it is not abandonment by itself.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. This is a meaningful maintenance concern, partly offset by the repository having been pushed in January 2025.

Security policycaution

The linked repository has no security policy. This is a transparency gap for a package handling file uploads, although the package otherwise has a clear repository and release documentation.

Workflow auditcaution

All three workflows were analyzed without untrusted checkouts or script injection, but the release workflow uses a container image tagged latest with high confidence. That weakens build reproducibility and release transparency.