claudiodekker/changelog-updater

Release historycaution

The package has only 3 releases since April 2023 and none in the last 12 months, with releases typically about 14 months apart. This indicates slow maintenance, though the latest release is still relatively recent.

Repo commit activitycaution

There were no commits and no active maintainers in the last 3 months, despite the repository being collected about 13 months after the latest release. This is a meaningful maintenance warning.

Repo toolingcaution

Composer is used for builds, but no security scanning tooling is reported. This is a transparency and maintenance-hygiene gap, not evidence that the release is unsafe.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented. This is a modest transparency gap for a maintained library.

Workflow auditcaution

All 3 workflows were analyzed, but 7 of 10 action references are unpinned; the audit also found high-confidence template injection and an unpinned container image. The pull_request_target trigger has no untrusted checkout or script-injection sink, so these remain hygiene concerns rather than standalone severe risks.