markup-carve/tempest-highlight-carve

Release historycaution

This is the package's first release, published on the assessment date, so there is no release history or cadence establishing long-term maintenance.

Repo commit activitycaution

No commits or active maintainers were recorded in the last three months, but the repository and release are newly created, so this is limited evidence rather than proof of abandonment.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected. The missing scanner is a hygiene gap, partly offset by the repository's other quality controls.

Version stabilitycaution

Version 0.1.0 is not a stable major release, which signals an early-stage API, although it is not marked as a prerelease.

Workflow auditcaution

The workflow audit completed fully, found no dangerous triggers or audit findings, and uses read-only permissions. However, both referenced actions are unpinned, weakening build reproducibility and action supply-chain protection.