purc/mp-article-include

Release historycaution

The latest registry release was published more than three years ago, with no releases in the last 12 months. This is a meaningful maintenance concern, although recent repository activity provides some compensation.

Repo bus factorcaution

All two recent commits came from one contributor, leaving maintenance dependent on a single person. The linked repository is individually owned, so there is no organizational handoff evidence to offset that concentration.

Repo toolingcaution

Composer is used for builds, which supports reproducibility, but no security-scanning tooling was detected. That is a modest process gap for a package intended to run in applications.

Security policycaution

The repository has no published security policy. This limits transparency around vulnerability reporting and response, though it is not evidence of a security defect by itself.