devuri/env

Repo commit activitydanger

There were no commits and no active maintainers in the last three months, consistent with the long release gap. This is a meaningful abandonment risk for a library dependency.

Project backingcaution

The package and repository are owned by the same individual account, so the source relationship is clear. There is no organization backing shown to provide a broader maintenance base.

Release historycaution

The package has had no release in about two years and five months, with no releases in the last 12 months. The ten-release history shows an initially active project but does not offset the current gap.

Security policycaution

The repository has no security policy. This is a transparency and vulnerability-reporting gap, though the presence of Dependabot and Psalm partly compensates.

Version stabilitycaution

Version 0.3.2 is not a stable major release, which signals a less mature compatibility commitment. It is not marked as a prerelease, so the concern is limited.