foovar/jp-invoice

Release historycaution

The package is only 33 days old and has one release, so there is little evidence yet about long-term maintenance or release consistency.

Repo bus factorcaution

All 17 recent commits came from one contributor, leaving maintenance dependent on a single person and increasing abandonment risk.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected; this is a modest transparency and maintenance gap for a new package.

Security policycaution

The repository has no security policy, which leaves vulnerability-reporting expectations undocumented.

Workflow auditcaution

The workflow audit completed cleanly with no dangerous triggers or audit findings, but both analyzed action references are unpinned, weakening build reproducibility.