common-gateway/zgw-bundle

Release historycaution

The package has 135 releases since December 2022, but none in the last two years; the latest release was in September 2024. This is a meaningful maintenance concern despite its previously frequent release cadence.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months, while the repository was last pushed in September 2024. This supports the concern that maintenance has stopped.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, so the package-to-source relationship is less transparent. Organization backing partly offsets this concern but does not remove it.

Security policycaution

The linked repository has no security policy, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

All 20 analyzed action references are unpinned, and one workflow uses an archived action; a separate workflow installs a package outside a lockfile. No untrusted checkout or script-injection path was found, so this is workflow hygiene risk rather than a severe risk.