oat-sa/lib-lti1p3-ags

Release historycaution

The package has 16 releases over about 5 years, but none in the last 12 months. This is a meaningful maintenance concern, although the repository was pushed recently and the assessed release has documented notes.

Repo bus factorcaution

One contributor made all commits in the last 3 months. Organization backing provides some handoff capacity, but current observed activity is still concentrated in one person.

Repo commit activitycaution

Only one commit was recorded in the last 3 months, showing some recent activity but a slow current maintenance pace. This partially offsets the absence of recent registry releases without removing the concern.

Security policycaution

No repository security policy was found. For a library handling LTI services, this reduces transparency around vulnerability reporting and response.

Workflow auditcaution

Both workflows were analyzed successfully with no untrusted checkouts, script injection, or high-severity findings, and neither uses broad top-level write permissions. However, all 6 of 6 action references are unpinned, leaving avoidable build reproducibility and action-supply-chain risk.