symkit/metadata-bundle

Release historycaution

The package has only three releases, all published within roughly 14 hours, followed by no newer release during its 210-day lifetime. That leaves limited evidence of sustained maintenance.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months. For a package only about seven months old, that is a meaningful maintenance and abandonment concern.

Security policycaution

The repository has no published security policy. This is a transparency gap, though the available security scanning and organization backing provide some compensation.

Version stabilitycaution

Version v0.0.3 is not a stable major release, so its API may still change. The absence of recent prereleases avoids adding another instability concern.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkout, injection, or high-severity findings, but all 12 action references are unpinned. The missing top-level permissions block is acceptable on its own, while unpinned references remain a supply-chain hygiene concern.