react/datagram

Release historycaution

The package has existed since 2014 with 13 releases, but it has had no registry release in about two years; this is a real maintenance concern despite the long project history.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months, indicating limited recent development activity even though the repository is not archived.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tooling was detected; this is a modest transparency and hygiene gap.

Security policycaution

The repository has no published security policy, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all 3 action references are unpinned, which weakens build reproducibility and supply-chain hygiene.