ustadev/yii2basic

Licensecaution

The artifact declares MIT and includes a license file, but the detected license text is BSD-3-Clause. The repository also has a license file, so this is a license-consistency concern rather than an absence of licensing.

Release historycaution

The package has nine releases over about three years, but none in the last 12 months; the latest release was published about 16 months ago. This weakens confidence that the template is actively maintained.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Although it was pushed more recently than the assessed release, the current lack of development activity raises abandonment risk.

Security policycaution

The repository has no security policy. This is a transparency and reporting gap, though it is not evidence that the package is unsafe by itself.

Workflow auditcaution

The single workflow was fully analyzed, uses read-only permissions, and has no dangerous audit findings. However, both of its two action references are unpinned, leaving the workflow exposed to upstream action changes.