commongateway/corebundle

Dependency profilecaution

The package declares 61 runtime dependencies, including several major framework, database, storage, and document-processing components. This broad dependency surface increases upgrade and compatibility burden.

Licensecaution

The manifest declares MIT, but the artifact license file is identified as EUPL-1.2. Although a license file exists, the mismatch creates a real obligation and compatibility concern.

Release historycaution

The package has 360 releases since February 2023 and the latest release is recent, but only 4 releases occurred in the last 12 months, indicating a much slower current cadence than its roughly 19-hour historical median interval.

Repo commit activitycaution

The repository had no commits and no active maintainers in the last 3 months. This suggests reduced maintenance capacity, though the recent registry release provides some compensating evidence.

Workflow auditcaution

All 27 analyzed action references are unpinned, and one high-confidence medium-severity finding uses an archived action; two workflows also install packages outside a lockfile. There are no untrusted checkouts or script-injection findings, which limits the risk.