dbp/relay-verity-connector-verapdf-bundle

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, a meaningful sign of slowing maintenance despite a recent package release and repository push.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving an avoidable transparency and maintenance gap.

Security policycaution

The repository has no security policy, so the process for reporting and handling vulnerabilities is unclear.

Version stabilitycaution

Version 0.1.8 is not a stable-major release, so API compatibility may still evolve, although it is not marked as a prerelease and recent prerelease share is zero.

Workflow auditcaution

All six analyzed GitHub Actions references are unpinned, which weakens build reproducibility and supply-chain hygiene. The workflow has no untrusted checkout or script-injection findings, and its missing top-level permissions block is not a concern by itself.