plaisio/lock-named-core

Release historycaution

The package has nine releases over about 6 years 10 months, but no releases in the last 12 months; the latest release was about 15 months ago. This suggests slowing maintenance rather than abandonment on its own.

Repo commit activitycaution

There were no commits and no active maintainers in the last 3 months, consistent with the long gap since the latest release. This lowers confidence in ongoing maintenance, although it does not establish abandonment by itself.

Repo toolingcaution

The repository uses Composer and Phing, showing an established build process, but it reports no security scanning tools. The missing scanning is a modest transparency gap rather than a severe dependency risk.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented. This is a transparency weakness for a package intended to be depended on.

Workflow auditcaution

The single workflow was fully analyzed, uses read-only permissions, and has no dangerous triggers or audit findings. However, all four action references are unpinned, leaving avoidable update and provenance risk.