directorytree/opensearch-migrations

Release historycaution

The package is only 102 days old and has two releases, with a 31-day median interval. This is limited maturity evidence, though both releases were published within the last 12 months.

Repo bus factorcaution

All eight recent commits came from one contributor, creating concentration risk. Organization backing partly offsets this because maintenance can be handed off, but no second active contributor is shown.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. This is a modest transparency gap for a package with only a short release history.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

All five analyzed workflow action references are unpinned, so their exact revisions are not reproducibly fixed. One workflow also grants top-level write permissions, but there are no untrusted checkouts, script injections, or higher-confidence audit findings.