prinsfrank/glyph-lists

Release historycaution

There has been only one release, published about 12 months ago, so there is little release history to demonstrate sustained maintenance. For a static glyph-list package this may be adequate, but it leaves long-term upkeep uncertain.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, roughly a year after its only release. Static data may require few changes, but this is the main evidence of uncertain ongoing maintenance.

Security policycaution

No security policy is present. This is a transparency gap, though the package is a small static data library with minimal runtime dependencies and no reported dangerous workflow patterns.

Token permissionscaution

The only workflow lacks top-level token permissions, so its effective permissions are not explicitly minimized in the workflow file. No top-level write permissions were observed, making this a minor workflow-hygiene concern rather than a severe risk.