atk4/ui

Release historycaution

The package has a long history of 72 releases with a typical interval of about 14 days, but it has had no registry release in the last 12 months. This is a meaningful publishing slowdown, partly offset by recent repository activity.

Repo issue activitycaution

There were no new or closed issues in the last month and only one pull request was merged, indicating limited recent issue throughput despite continued source activity.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. For a framework with a substantial dependency and release surface, this is a modest transparency and maintenance gap.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

All three workflows were analyzed without untrusted triggers or script injection, but all 13 action references are unpinned and high-confidence findings report unpinned container images; two workflows also install packages outside a lockfile. These are workflow supply-chain hygiene weaknesses, not evidence that the package itself is unsafe.