cslant/telegram-git-notifier

Release historycaution

The latest registry release was over two years ago, with no releases in the last 12 months. The repository was pushed recently, which provides some evidence of activity but does not offset the stale published release cadence.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. A recent repository push is compensating evidence of some activity, but the measured development pace remains weak.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented. Dependabot scanning provides some compensating security process, but not a replacement for a published policy.

Workflow auditcaution

All 11 action references are unpinned, and the audit found high-confidence bot-condition and unpinned-container-image issues; three workflows also grant top-level write permissions. No untrusted checkout or script-injection sink was found, so these are significant hygiene concerns rather than a standalone severe dependency risk.