wikibase/internal-serialization

Release historydanger

The package has 19 releases over about 12 years but none in the last 6 years, making this release materially stale even though the historical cadence was established.

Repo bus factorcaution

All recent commit activity comes from one contributor. Organization backing provides some handoff capacity, but no second active contributor is evidenced in this period.

Repo commit activitycaution

The repository received one commit in the last 3 months, showing some activity but little demonstrated maintenance capacity relative to the package's long release gap.

Security policycaution

The linked repository has no security policy. This is a transparency gap for a maintained library, although it is less significant than the release-age concern.

Workflow auditcaution

The workflow is fully analyzed, uses read-only job permissions, and has no reported audit findings, but all 5 referenced actions are unpinned, reducing build reproducibility and pinning supply-chain inputs.