diogocomposer/php-europass

Release historycaution

This is the first release and the package is only 0 days old, so there is no release history to demonstrate sustained maintenance. The linked repository is active at publication time, but that does not establish long-term durability.

Repo commit activitycaution

There were 0 commits and 0 active maintainers in the last 3 months, but the repository and first release were created on the same day. This is mainly an unproven maintenance record rather than evidence of abandonment.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations unclear. This is a modest transparency gap for a new library, though the package's documented local XML-generation role limits its significance.

Version stabilitycaution

v0.1.0 is a stable, non-prerelease version, which is better than an explicitly experimental prerelease. However, the initial major version and single release provide little evidence of compatibility over time.

Workflow auditcaution

The single workflow is fully analyzed, uses read-only permissions, and has no untrusted checkout, script-injection, or audit findings. All 6 action references are unpinned, which weakens build reproducibility and supply-chain protection despite the otherwise restrained workflow permissions.