sycho/flarum-github-milestone

Release historycaution

The package has four releases since November 2020, but none in the last 12 months and its latest registry release was about 20 months ago. That weakens confidence in ongoing maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. This is a meaningful maintenance concern despite the repository remaining unarchived.

Repo toolingcaution

Composer is used for builds, but no security scanning tool was detected. That is a modest transparency and maintenance gap for a package with active build workflows.

Security policycaution

The repository has no security policy. For an extension that makes GitHub API requests, this leaves vulnerability reporting and response expectations unclear.

Workflow auditcaution

Both workflows were fully analyzed with no dangerous triggers, untrusted checkouts, injection findings, or audit failures. However, both of the two action references are unpinned, leaving their exact executed revisions uncontrolled.