mediawiki/semantic-approved-revs

Release historycaution

The latest registry release was over three years ago and there were no releases in the last 12 months, which raises maintenance concerns. Recent repository activity provides partial compensation but does not restore release cadence.

Repo bus factorcaution

All three recent commits came from one contributor, leaving a thin active contributor base. Organization ownership provides some handoff capacity but does not remove the concentration concern.

Repo toolingcaution

The project uses Make and Composer build tooling, but no security scanning tools were detected. This is a modest transparency and assurance gap rather than a severe risk.

Security policycaution

The repository has no published security policy, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

The only workflow was fully analyzed and had no dangerous triggers, untrusted checkouts, or audit findings, but both of its two action references are unpinned. That weakens build reproducibility and supply-chain hygiene.