filagora/filagora-messages

Release historycaution

This is the first release, published less than a day ago, so there is no track record for maintenance or compatibility yet. The repository's tests and release notes provide some compensating transparency.

Repo commit activitycaution

The repository reports zero commits and zero active maintainers in the last three months, but the package itself is only hours old, so this is better read as insufficient history than collapsed maintenance.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. Repository tests and the documented security policy partly compensate for this tooling gap.

Version stabilitycaution

Version v0.1.0 is an unstable-major release, and the README explicitly says the API may change between 0.x minor versions. That is a compatibility concern for dependents, not evidence of abandonment.

Workflow auditcaution

All four action references are unpinned, one workflow has top-level write permissions, and a high-confidence medium-severity secrets-inherit finding passes credentials to a reusable workflow. The audit covered both workflows and found no untrusted checkout or script injection.