tipsyphp/tipsy

Release historycaution

The registry reports the latest release as July 2014 and no releases in the last 12 months, which conflicts sharply with the assessed v2.0.0 release and its published release notes. This inconsistency reduces release transparency, despite repository evidence of current work.

Repo bus factorcaution

All four recent commits came from one contributor, creating concentrated maintenance capacity. Organization ownership provides some handoff potential, but no second recently active contributor is shown.

Repo issue activitycaution

There are 16 open issues but no issues or pull requests were opened, closed, or merged in the last month. The lack of recent issue activity is a modest maintenance concern, not evidence of abandonment by itself.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting expectations and response guidance unclear. The presence of security scanning partly offsets this gap but does not replace a policy.

Workflow auditcaution

All 16 action references are unpinned, and one release workflow has top-level write permissions; both are workflow hygiene concerns. The audit also reports high-confidence template-injection findings, but without an accompanying dangerous trigger or sink they remain hygiene rather than a standalone severe risk.