milpa/mercure

Release historycaution

The package is 74 days old with only one release, so its maintenance record and long-term stability are not yet established.

Repo bus factorcaution

All 11 recent commits came from one contributor, leaving maintenance highly dependent on a single person even though the repository is organization-owned.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected, leaving a modest security-process gap.

Version stabilitycaution

Version 0.1.0 is an early major version, which signals a greater likelihood of breaking changes than a mature stable-major release.

Workflow auditcaution

All four workflows were analyzed with no dangerous sinks or audit findings, but all seven action references are unpinned and three workflows grant top-level write permissions. These are CI hygiene concerns rather than severe risks because no untrusted trigger or injection sink was found.