peppol-sh/sdk

Release historycaution

This is a very new package with only two releases over about one day, so there is not enough history to demonstrate sustained maintenance.

Repo commit activitycaution

The repository records zero commits and zero active maintainers in the last three months. Because the package is brand new and was pushed today, this is limited evidence rather than proof of abandonment, but it leaves maintenance capacity unestablished.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving a modest transparency and maintenance gap.

Version stabilitycaution

Version 0.2.0 is not a stable major release, which signals an immature API and greater compatibility risk for dependents.

Workflow auditcaution

Both workflows were analyzed cleanly with no dangerous sinks or audit findings, but all 11 action references are unpinned and one workflow grants top-level write access, creating workflow hygiene risk.