jar/jar_columnrow

Licensecaution

The artifact contains a license, but the manifest declares GPL-2.0-or-later while the detected license file is GPL-3.0. This mismatch reduces licensing clarity.

Repo bus factorcaution

One contributor made all commits in the last three months. Because the repository owner is recorded as a user rather than an organization, this concentration leaves limited demonstrated handoff capacity.

Repo commit activitycaution

Only one commit was recorded in the last three months, showing limited recent source activity despite the active release history.

Security policycaution

The repository has no security policy. This is a transparency and vulnerability-reporting gap, although it does not by itself show that the package is unsafe.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous audit findings, but both of its two action references are unpinned. The absence of a top-level permissions block is acceptable here because no broad write permission was observed.