aura/sqlschema

Release historycaution

The package has existed for about 12 years with 6 releases, but only 1 release in the last 12 months and a median interval of about 319 days indicate a deliberately slow or limited release cadence. The recent release is compensating evidence against outright abandonment, so this is a caution rather than a severe risk.

Repo commit activitycaution

There were 0 commits and 0 active maintainers in the last 3 months, indicating a thin or currently inactive maintenance stream. Recent merged pull requests and the current release partially compensate, but this remains the strongest maintenance concern.

Repo toolingcaution

Composer is used as a build tool, but no security scanning tools are configured. The missing scanning reduces security-process transparency, though it does not by itself establish that the package is unsafe.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations and response procedures undocumented. This is a transparency gap, although the package's small scope and other repository hygiene provide limited context rather than direct compensation.

Token permissionscaution

Both workflows lack top-level permissions declarations, and one relies on job-level permissions only. No workflow has top-level write permissions, which limits the concern, but explicit least-privilege declarations would provide better workflow hygiene.