envor/libstream

Release historycaution

The package has 8 releases but none in the last 12 months; its latest registry release was about two years ago. The release notes for this version provide some documentation, but the long release gap lowers maintenance confidence.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Despite a push in June 2026, the recent activity window shows weak ongoing maintenance.

Repo issue activitycaution

There are four open pull requests, with no new or merged pull requests in the last month. This is a modest sign of stalled review activity, though there are no open issues.

Security policycaution

No SECURITY.md or equivalent security policy was found. This weakens vulnerability-reporting transparency for a library intended for application integration.

Workflow auditcaution

All five workflows were analyzed, but all 12 action references are unpinned. The audit also found a high-confidence bot-conditions issue in the Dependabot auto-merge workflow; the pull_request_target trigger has no untrusted checkout or script-injection sink, so this is workflow hygiene risk rather than a severe standalone failure.