discoverygarden/islandora_member_of_entailment

Release historycaution

The package is only 35 days old, with six releases all published on the same day and no established release interval. That supports an immature maintenance picture rather than a proven long-term dependency.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. Although the repository is organization-owned and recently released, this leaves current maintenance momentum unproven.

Repo toolingcaution

Composer is used for the build, but no security scanning tools were detected. The missing scanning is a repository hygiene gap, not evidence that the package is unsafe.

Security policycaution

The repository has no security policy. That weakens transparency about vulnerability reporting and response expectations.

Workflow auditcaution

All five action references are unpinned, and the audit found a high-confidence medium-severity secrets-inherit finding in phpunit.yml. The pull_request_target trigger has no untrusted checkout or script-injection sink, so it is not independently dangerous.