the-pantry/lightweight-spreadsheet

Release historycaution

The package is only 62 days old with two releases published on the same day, so long-term maintenance maturity is not established; recent commit activity provides some compensation.

Repo bus factorcaution

All five recent commits came from one contributor, leaving maintenance dependent on a single active developer; organization backing helps but does not remove the concentration.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool is reported, leaving a modest transparency gap.

Security policycaution

The repository has no security policy, so the reporting and handling path for vulnerabilities is unclear.

Workflow auditcaution

The one workflow was fully analyzed, uses read-only permissions, and has no dangerous triggers or audit findings; however, all three referenced actions are unpinned, which weakens build reproducibility.