friendsofcake/crud

Release historycaution

The package is mature, with 71 releases over roughly 13 years, but it has had no registry release in the last 12 months. The long median interval is outweighed by the current pause, which raises maintenance concern.

Repo commit activitycaution

There were no commits and no active maintainers in the last 3 months. Although the repository was pushed in January 2026, the recent lack of development lowers confidence in ongoing maintenance.

Security policycaution

No repository security policy was found. This is a transparency gap for a production-oriented framework component, though Dependabot provides some compensating security tooling.

Workflow auditcaution

The single workflow was fully analyzed and uses read-only permissions, with no untrusted checkout or script-injection findings. However, it inherits secrets with high-confidence medium severity and both action references are unpinned, creating build-hygiene concerns.