dragon-code/contracts

Release historycaution

The package has 99 releases over nearly five years, but only one release in the last 12 months. That recent slowdown is a maintenance concern despite the substantial release history.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months. Combined with only one release in the last year, this indicates recently quiet maintenance.

Security policycaution

The linked repository has no published security policy. This weakens vulnerability-reporting transparency, although Dependabot is present as a compensating security tool.

Workflow auditcaution

All 7 analyzed action references are unpinned, which weakens build reproducibility and supply-chain hygiene. The audit found no untrusted checkouts, script injection, or high-severity findings; the single top-level write workflow is only a mild concern without an untrusted trigger.