pdir/animated-timeline-bundle

Licensecaution

The package declares LGPL-3.0-or-later and includes license files, but the artifact also detects MIT, creating a licensing mismatch that should be clarified before adoption.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers during the last 3 months. Although a recent release provides some compensating evidence, this still indicates limited current development activity.

Repo toolingcaution

The repository uses Composer but has no detected security scanning tools. The lack of scanning is a modest transparency and maintenance gap, not evidence of abandonment by itself.

Security policycaution

No repository security policy was found, leaving vulnerability reporting expectations undocumented. This is a moderate transparency gap for a package intended for application integration.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkout or script-injection findings, but all six action references are unpinned. The workflow also lacks a top-level permissions block, which is acceptable on its own; unpinned actions remain a supply-chain hygiene concern.