orchestra/html

Release historycaution

The package has 68 releases and a long history, but it has had no releases in about five years. That materially raises abandonment and compatibility risk.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months, consistent with maintenance having stopped for about five years. The established release history and organization backing provide context but do not restore current activity.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. This is a modest transparency and assurance gap.

Security policycaution

The repository has no published security policy, leaving vulnerability reporting and response expectations unclear.

Workflow auditcaution

Both workflows were fully analyzed with no dangerous sinks or audit findings, but all six referenced actions are unpinned. The missing top-level permissions blocks are acceptable on their own under the audit rules.