dvsa/mot-cpms-common

Release historycaution

The package has existed for about 3 years and 4 months with five releases, but only one release in the last 12 months and a median interval of about 200 days indicate a measured rather than rapid cadence.

Repo bus factorcaution

One contributor made all seven commits in the last 3 months, creating a meaningful continuity risk; organization ownership provides some ability to hand maintenance off.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools were detected, leaving a modest security-process gap.

Security policycaution

The repository has no security policy, which makes vulnerability reporting and response expectations less transparent.

Workflow auditcaution

The single workflow was fully analyzed with no injection or high-severity findings, but all three action references are unpinned, weakening build reproducibility and action supply-chain hygiene.