setono/dependency-tracker

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers in the last three months, while its last push coincided with the initial release about five months ago. This is the strongest maintenance concern.

Release historycaution

This is a young package with only one release, published about five months ago, so its maintenance track record is still limited.

Repo toolingcaution

The project uses Composer build tooling, but no security scanning tools were detected, leaving a modest transparency and hygiene gap.

Security policycaution

The repository has no security policy, which makes vulnerability reporting less explicit for a package intended to run as a Composer plugin.

Workflow auditcaution

All 19 analyzed action references are unpinned, weakening build reproducibility. The audit found no injection, untrusted checkout, secret, or write-permission findings, which keeps this a hygiene concern rather than a severe workflow risk.