datlechin/flarum-oauth-spotify

Release historycaution

This is the package's only release, published about three years ago, with no releases in the last 12 months. That is a meaningful maintenance concern, although the linked repository was pushed recently.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the past three months. This weakens evidence of ongoing maintenance despite the repository not being archived.

Security policycaution

The linked repository has no security policy. This reduces transparency for reporting and handling security issues, though it does not by itself make the release unfit.

Workflow auditcaution

The sole workflow was fully analyzed with no dangerous triggers or audit findings, but its one action use is unpinned. That is a modest reproducibility and supply-chain hygiene gap.