hyde/ui-kit

Release historycaution

This is the only release, published about 2 years 8 months ago, with no releases in the last 12 months. That limits evidence of ongoing registry maintenance, although recent repository activity provides some compensation.

Repo bus factorcaution

All 2 recent commits came from one contributor, leaving maintenance concentrated in a single person. Organization ownership provides some handoff capacity but does not eliminate the concentration concern.

Repo toolingcaution

Composer build tooling is present, but no security scanning tooling was detected. For this small component package, that is a modest transparency and maintenance gap rather than a severe risk.

Workflow auditcaution

The sole workflow was fully audited with no dangerous triggers or findings, and it scopes permissions at job level. Both action references are unpinned, which leaves workflow dependencies less reproducible.