markocupic/contao-picture-downloads

Release historycaution

The package has had 6 releases since December 2021, but none in the last 12 months and the latest release was over two years ago. This materially raises abandonment risk despite the earlier release cadence.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months, consistent with the repository having had no push for over two years. This is the strongest maintenance concern.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. This is a modest transparency and maintenance gap rather than evidence of an unsafe release.

Security policycaution

The repository has no security policy. For a small extension this is a transparency gap, though it is less serious than the inactive maintenance signals.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, or audit findings. However, both of its action references are unpinned, leaving avoidable build-reproducibility risk.