janwebdev/translatable-entity-bundle

Project backingcaution

The registry and repository are owned by the same individual account, so ownership is consistent. This does not provide organization-level maintenance redundancy.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last 3 months, and its last push was January 25, 2026. That quiet period is a real maintenance concern despite the recent release history.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. The missing scanning is a modest hygiene gap rather than a standalone adoption blocker.

Security policycaution

The repository has no security policy, so the process for reporting vulnerabilities is unclear. This is a transparency gap, though it is not evidence of a vulnerability by itself.

Workflow auditcaution

The only workflow was fully analyzed with no untrusted checkouts, injection findings, or write-wide permissions. However, both of its action references are unpinned, leaving avoidable workflow supply-chain exposure.