mathsgod/hl-holiday

Project backingcaution

The registry and repository are owned by the same individual account, so the source linkage is coherent. Individual ownership also indicates a relatively narrow backing base.

Release historycaution

The package has 12 releases since March 2020, but none in the last 12 months and the latest was about two years ago. That suggests slowing maintenance for a holiday-data package whose freshness matters.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. Combined with the roughly two-year release gap, this is meaningful evidence of limited current maintenance.

Security policycaution

The repository has no security policy. This is a modest transparency gap, but it is not severe enough to outweigh the package's clear license, tests, and simple dependency profile.

Workflow auditcaution

The single workflow was fully analyzed, uses read-only permissions, and has no detected dangerous sinks or audit findings. However, both action references are unpinned, leaving avoidable supply-chain hygiene risk.