nckrtl/filament-resource-templates

Release historycaution

The package has only 3 releases across about 2 years and 4 months, with just 1 release in the last 12 months and a median interval of about 393 days. That slow cadence is a maintenance concern, although the latest release is recent.

Repo bus factorcaution

All 6 recent commits came from one contributor, leaving no demonstrated second maintainer to provide continuity if that person becomes unavailable.

Security policycaution

The repository has no published security policy, so there is no documented process for reporting or handling vulnerabilities. This is a transparency gap rather than evidence of an unsafe release.

Version stabilitycaution

Version 0.3 is not a stable major release, so the package may still undergo breaking changes. It is not marked as a prerelease, which partly offsets that concern.

Workflow auditcaution

All 12 analyzed action references are unpinned, and three workflows grant top-level write permissions. The high-confidence bot-conditions finding in the Dependabot auto-merge workflow adds workflow hygiene risk, although no untrusted checkout or script injection was found.