joomla/input

Release historycaution

The package has existed since 2013 with 27 releases, but it had no registry release in the last 12 months and its latest release was over a year ago. Recent repository activity partly compensates for the slower registry cadence.

Repo bus factorcaution

All three recent commits came from one contributor, creating a meaningful continuity risk. Organizational backing reduces the risk somewhat because maintenance can potentially be handed off, but no second active contributor is shown.

Repo toolingcaution

Composer build tooling is present, supporting a reproducible project structure, but no security scanning tools were detected; the security gap is limited because other repository security controls are present.

Token permissionscaution

The CI workflow lacks top-level token permissions, so its default permissions are not explicitly constrained. No write permissions were observed, but explicit least-privilege configuration would improve transparency.