phlak/semver-cli

Release historycaution

The package has had no registry release in over two years, despite ten releases overall; this is meaningful evidence of stalled maintenance for a CLI tool.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, reinforcing the extended release gap and increasing abandonment risk.

Security policycaution

The linked repository has no security policy, which reduces transparency for reporting and handling vulnerabilities, although the available Dependabot and Psalm tooling partly compensates.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous findings, but all six action references are unpinned. The absence of a top-level permissions block is acceptable on its own, while unpinned actions remain a build-hygiene weakness.