sbominator/sbom-typo3

Release historycaution

This is the package's only release, published about 18 months ago, with no releases in the last 12 months. That limited history makes ongoing maintenance uncertain.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Combined with the single-release history, this raises abandonment risk.

Security policycaution

The linked repository has no security policy, leaving vulnerability reporting and response expectations undocumented.

Version stabilitycaution

The package is still at version 0.1.0, indicating an early-stage integration despite not being marked as a prerelease.

Workflow auditcaution

The audit covered the single workflow and found no dangerous sinks, but its only action reference is unpinned and the workflow grants top-level write permissions. These are workflow hygiene concerns, not severe risks on their own.