echo-fusion/configmanager

Release historycaution

Only two releases appeared on the same day, so there is not yet enough history to demonstrate sustained maintenance or established release practice.

Repo commit activitycaution

There were no commits and no active maintainers in the previous three months, but the repository and package are only hours old, so this is limited maturity evidence rather than abandonment proof.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected; this is a modest transparency and assurance gap for a new package.

Security policycaution

No security policy is present. For a small new library this is a hygiene gap, though the clear README, tests, and license partly compensate.

Workflow auditcaution

The single workflow was fully analyzed, uses read-only permissions, and has no untrusted checkout or injection findings; however, both action references are unpinned, leaving avoidable update risk.