Package Health/team-nifty-gmbh/tall-calendar

team-nifty-gmbh/tall-calendar

The MIT license, release notes, and matching organization-backed repository provide useful transparency. No commits in the last three months and no registry releases in over a year weaken maintenance confidence, while a high-confidence workflow condition issue adds a smaller supply-chain hygiene concern.

Latest v1.0.0-beta.1

Packagist

62%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has 34 releases over roughly three years, but none in the last 12 months; the long release gap lowers confidence in ongoing maintenance.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last three months; this is a concrete maintenance warning, only partly offset by the later repository push timestamp.

Security policy

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented. Dependabot provides some compensating security tooling but does not replace a policy.

Version stability

The assessed release is v1.0.0-beta.1 while the registry reports v0.6.12 as latest and does not identify a stable major release, so adoption carries pre-release and version-line uncertainty.

Workflow audit

All workflows were analyzed, but every action reference is unpinned and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. Its pull_request_target trigger has no untrusted checkout or script-injection sink, so this is a hygiene concern rather than a severe workflow risk.