pressbooks/pressbooks-donham

Release historycaution

The package has existed since 2017 but has only six releases, with no registry release in more than two years. That is a meaningful sign of slowing maintenance for a dependency.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the long gap since the latest release. This raises abandonment risk despite the package's established history.

Security policycaution

The repository has no security policy, which reduces transparency for reporting and handling vulnerabilities. This is a modest concern for a mature package, not evidence that the package is unsafe.

Workflow auditcaution

All three analyzed action references are unpinned, and a high-confidence medium-severity secrets-inherit finding affects the release workflow. There are no untrusted checkouts or script-injection findings, so this is avoidable hygiene risk rather than a severe workflow threat.