gupalo/item-syncer

Release historycaution

The package has existed for about 3 years and 8 months with 12 releases, but only one release in the last 12 months; this suggests a slow current cadence.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. Although a release was published during the broader period, the recent absence of development lowers maintenance confidence.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected; this is a modest transparency and maintenance gap.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

All four analyzed action references are unpinned, so workflow dependencies can change without a reviewed commit. The workflow has no untrusted checkout or script-injection findings, and lacking a top-level permissions block is acceptable on its own.