directorytree/opensearch-client

Release historycaution

This is a young package, 96 days old, with only one release and no established release cadence. That limits evidence of long-term maintenance but does not by itself indicate abandonment.

Repo bus factorcaution

One contributor made all 6 commits in the last 3 months, creating a thin maintenance base and elevated continuity risk. Organization backing partly compensates because maintenance can potentially be handed off.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. The missing scanning is a modest transparency and hygiene gap for a dependency published to a registry.

Security policycaution

The repository has no security policy. This is a maintenance and disclosure-process gap, though it is not evidence that the release is unsafe.

Workflow auditcaution

Both workflows were analyzed with no audit findings or untrusted-trigger sinks, but all 5 action references are unpinned and one workflow grants top-level write permissions. These are workflow hygiene concerns rather than severe risks here.