bradp/dotenv

Release historydanger

The package has had no release in about 5 years, with zero releases in the last 12 months. This is the strongest evidence of possible abandonment, although the repository remains available.

Repo commit activitydanger

There were zero commits and zero active maintainers during the last 3 months. Combined with the old registry release, this indicates weak current maintenance capacity.

Repo toolingcaution

The repository uses Composer, but no security scanning tools were detected. This is a modest transparency and maintenance gap rather than evidence of abandonment by itself.

Security policycaution

The repository has no published security policy. That makes vulnerability reporting less transparent, though it is less serious than the stale release and commit history.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, or audit findings. However, both of its action references are unpinned, leaving avoidable build reproducibility risk.