cmsexperts/bolt

Registry deprecationdanger

Packagist marks the package abandoned at package scope and points developers to b13/bolt as its replacement. This is a severe adoption risk even though the linked repository remains available.

Release historydanger

The last registry release was over two years ago, with no releases in the preceding 12 months. Its earlier history was established, but the current release cadence indicates abandonment risk.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months, consistent with the long gap since the latest release. This materially lowers confidence in ongoing maintenance.

Security policycaution

The linked repository has no security policy, leaving vulnerability-reporting and response procedures undocumented. This is a transparency gap, although it is secondary to the package's abandoned status.

Workflow auditcaution

All five analyzed action references are unpinned, and the publishing workflow has a high-confidence template-injection finding. The audit was complete, and the finding affects release-workflow hygiene even without an untrusted checkout or script-injection trigger.