rishadblack/wire-bootstrap

Release historycaution

This is the first release, published today, so there is no release history or cadence from which to judge sustained maintenance. That is a maturity concern, but not evidence of abandonment for a package released only moments ago.

Repo commit activitycaution

There were no commits or active maintainers in the three-month window, but the repository and release are only one day old, so this is better interpreted as unavailable history than a collapsed maintenance pattern.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. That leaves a modest transparency and preventive-maintenance gap.

Security policycaution

The repository has no security policy, so consumers have no documented vulnerability-reporting process. This is a hygiene gap rather than evidence that the package is unsafe.

Workflow auditcaution

The single workflow was fully analyzed with no audit findings, no untrusted checkout, and no script injection. However, all four action references are unpinned, reducing build reproducibility and supply-chain protection.