mbretter/stk-validation

Release historycaution

The package has 10 releases since August 2020, but none in the last 12 months and the latest release was nearly two years ago. This indicates materially slowed maintenance for a library dependency.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. Combined with no releases in the last year, this is meaningful evidence that maintenance has gone quiet.

Repo toolingcaution

Composer is used for builds, but no security scanning tool is present. That is a modest supply-chain hygiene gap, not evidence that the release is unsafe by itself.

Security policycaution

The repository has no security policy. This reduces transparency about how vulnerabilities are reported and handled, though it does not by itself show abandonment.

Workflow auditcaution

The single workflow was fully analyzed, has read-only permissions, and no dangerous audit findings, but all four action references are unpinned. Unpinned actions leave the build dependent on mutable references and are a meaningful hygiene concern.