pug-php/pug-assets

Dependency profilecaution

The package declares eight runtime dependencies, including several filter packages, increasing the maintenance surface for a small asset manager. The dependency list is explicit, which partly offsets the breadth.

Release historycaution

The latest release was published over five years ago, with no releases in the last 12 months. The package has a meaningful release history, but the long current gap raises abandonment risk.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the release gap. This is a significant maintenance concern despite the repository remaining available.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting expectations unclear. This is a transparency gap, though the package has a matching MIT license and an organization-backed repository.

Workflow auditcaution

All six analyzed action references are unpinned, which weakens build reproducibility. The audit found no untrusted checkouts, script injection, dangerous triggers, or high-severity findings, so this is a hygiene concern rather than a severe risk.