krystal/katapult

Release historycaution

The package has 29 releases over about six years, but none in the roughly 20 months since February 2025. That recent pause raises maintenance concern despite a previously established release history.

Repo commit activitycaution

The repository had zero commits and zero active maintainers during the last three months measured. Combined with no releases in roughly 20 months, this is meaningful evidence of slowed maintenance.

Repo toolingcaution

The project uses Make and Composer for builds, but no security scanning tools were detected. The missing scanning is a hygiene gap rather than evidence of abandonment by itself.

Security policycaution

The repository has no security policy. That weakens vulnerability-reporting transparency, although it is not by itself a severe dependency risk.

Workflow auditcaution

Both workflows were analyzed successfully and have no untrusted checkout or script-injection findings; one scopes permissions at job level. However, all 10 action references are unpinned and a high-confidence medium-severity archived action was found, creating workflow supply-chain hygiene concerns.