scssphp/source-span

Release historycaution

The package has only two releases over about 21 months, with one release in the last 12 months. This is a small but not inherently unhealthy history for a focused library, though it limits maturity evidence.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. For a small library this may reflect stability, but it provides weak evidence of ongoing maintenance.

Repo toolingcaution

The repository uses Composer build tooling but reports no security-scanning tools. The missing scanning is a modest transparency and maintenance gap, not evidence of a defect.

Security policycaution

The repository has no security policy. That reduces transparency about vulnerability reporting and response, although it does not by itself indicate abandonment.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, or audit findings. However, all 8 action references are unpinned, leaving CI exposed to upstream reference changes.