bland-industries/timing-api

Release historydanger

This is the only release, published about 2 years and 5 months ago, with no releases in the last 12 months. That leaves little evidence of sustained maintenance for a dependency.

Repo commit activitydanger

There were no commits and no active maintainers in the last 3 months. Combined with the single registry release, this is meaningful evidence of limited ongoing maintenance.

Security policycaution

The repository has no security policy, reducing transparency for reporting and handling vulnerabilities. Dependabot is configured, which partly compensates for this gap.

Version stabilitycaution

Version 0.0.1 is not a stable major release, so its API and behavior may still change substantially if development resumes. The GitHub release and release notes provide some transparency but do not offset the very early version.

Workflow auditcaution

All 12 analyzed action references are unpinned, and a high-confidence bot-conditions finding reports that actor context may be spoofable in the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, so this is a hygiene and workflow-risk concern rather than a severe standalone dependency verdict.