milpa/notifications

Release historycaution

The package is only 50 days old and has one release, so there is not yet enough history to demonstrate sustained maintenance. Its recent initial release is consistent with a genuinely new project rather than abandonment.

Repo bus factorcaution

All three commits in the last three months came from one contributor, so maintenance is concentrated. Organization backing provides some handoff capacity, but no second active contributor is shown.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected. For a new dependency this is a modest process gap, not evidence of abandonment by itself.

Version stabilitycaution

v0.1.0 is not a stable major release, which indicates an API may still change. The presence of a GitHub release and release notes provides some transparency but does not offset the early maturity stage.

Workflow auditcaution

All four workflows were analyzed with no audit findings, untrusted checkouts, or script injections. However, three workflows grant top-level write permissions and all seven action references are unpinned, creating moderate workflow hygiene and reproducibility concerns without an untrusted trigger sink.