jar/jar_dataflow

Licensecaution

The manifest declares GPL-2.0-or-later, but the artifact license file was detected as GPL-3.0. Although license files exist in both the artifact and repository, the mismatch requires clarification.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers during the last 3 months. A release was published recently, but the absence of recent commit activity leaves maintenance capacity less clear.

Repo toolingcaution

Composer is used for builds, but no security scanning tools were detected. This is a moderate transparency and maintenance gap rather than evidence that the package is unsafe.

Security policycaution

The repository has no security policy. That reduces transparency around vulnerability reporting, though it does not by itself indicate abandonment.

Workflow auditcaution

The single workflow was fully analyzed with no high- or medium-severity findings and no untrusted checkout or script-injection paths. However, both of its 2 action references are unpinned, weakening reproducibility and update control.