iwink/tree

Release historycaution

Only two releases exist, with the latest published in April 2022 and none in the last four years. This is a meaningful maintenance concern for a dependency, although the repository is not archived.

Repo commit activitycaution

No commits or active maintainers were recorded in the last three months. Combined with the old registry release history, this weakens evidence of ongoing maintenance.

Repo toolingcaution

Composer is used for the build, but no security scanning tooling was detected. This is a modest transparency and assurance gap, not evidence that the package is unsafe.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

Both workflows were fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all five action references are unpinned, which leaves builds exposed to moving action revisions.