rokka/client-bundle

Release historycaution

The package has 17 releases over more than 10 years, but its latest release was about 2 years and 8 months ago and it had no releases in the last 12 months. This indicates materially reduced maintenance activity.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last 3 months, consistent with the long gap since the latest release. The project is not archived, but current maintenance capacity appears limited.

Security policycaution

The repository has no security policy, which reduces transparency for reporting vulnerabilities. This is a modest concern rather than evidence that the package is unsafe.

Workflow auditcaution

All 4 analyzed references are unpinned, and the audit found two high-confidence unpinned container images in static.yml. No untrusted checkout, script injection, or overly broad top-level write permission was reported, but the image risk remains a build-integrity hygiene concern.