snellingio/folio-markdown

Release historydanger

There has been only one release, published over three years ago, with no releases in the last 12 months. That is strong evidence of an abandoned or incomplete release line.

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the long release gap and materially increasing maintenance risk.

Security policycaution

No security policy is present. This is a transparency and response-process gap, though it is less significant than the package's lack of recent release and commit activity.

Version stabilitycaution

The assessed version is a beta, and all recent releases are prereleases. This signals limited maturity and makes the package a less dependable long-term dependency.

Workflow auditcaution

All 12 analyzed action references are unpinned, three workflows grant top-level write permissions, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, so this is workflow hygiene and supply-chain caution rather than a standalone severe risk.