locomotivemtl/charcoal-app

Release historycaution

The package has 50 releases since March 2016, but none in the last 12 months and its latest registry release was in December 2021. The newer repository push shows some project activity, but does not offset the long absence of published releases.

Repo commit activitycaution

There were no commits and no active maintainers in the three months measured. The April 2025 push provides some contrary evidence, but the recent activity window still indicates limited ongoing maintenance.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools were detected. That is a transparency and maintenance gap, though not evidence that the package is unsafe by itself.

Workflow auditcaution

The single workflow was fully analyzed, uses read-only permissions, and has no untrusted checkout or script-injection findings. However, all three action references are unpinned, so workflow dependencies can change unexpectedly.