luyadev/luya-blog

Release historycaution

The package has only two releases and none in roughly four years since June 2022, indicating a prolonged release pause. This materially raises abandonment risk despite the stable 1.1.0 version.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the release history showing no activity since June 2022. The repository is not archived, but current maintenance capacity is weak.

Repo toolingcaution

Composer is used for the build, but no security scanning tools were detected. This is a modest transparency and maintenance gap rather than a severe concern.

Security policycaution

The repository has no security policy, leaving vulnerability reporting expectations unclear. This is a hygiene gap, partly offset by the package's otherwise clear source and licensing metadata.

Workflow auditcaution

The single workflow was fully analyzed with no audit findings or unsafe triggers, and it does not grant top-level write permissions. However, both analyzed action references are unpinned, which weakens build reproducibility.