roadiz/font-bundle

Repo commit activitycaution

No commits and no active maintainers were recorded during the last three months, which weakens evidence of ongoing development despite the recent registry release.

Repo toolingcaution

The repository uses Composer and Make, but no security scanning tools were detected, leaving security checks less visible.

Security policycaution

The repository has no security policy, so there is no documented channel or process for reporting vulnerabilities.

Version stabilitycaution

The assessed release is stable and not a prerelease, but the reported latest version is lower than v2.6.36, creating a registry metadata inconsistency.

Workflow auditcaution

All three analyzed action references are unpinned, which weakens build reproducibility. The reported cache-poisoning finding has low confidence and is therefore only a hygiene concern, not a severe risk.