wp-content-framework/controller

Release historydanger

The package has 71 releases since January 2019, but none in the last 12 months and its latest release was about five years ago. This strongly raises abandonment risk despite the earlier regular weekly cadence.

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the release gap and indicating no recent maintenance capacity.

Workflow auditdanger

All 48 analyzed action references are unpinned, and a high-confidence unpinned container image plus an untrusted checkout in a pull_request_target workflow create meaningful build and automation risk. The low-confidence GITHUB_ENV finding is only a secondary hygiene concern.

Licensecaution

The release includes a license file, but the registry declares GPL-2.0+ while the artifact license file was detected as GPL-3.0. That mismatch needs clarification before use in a project with licensing constraints.

Security policycaution

The linked repository has no security policy, leaving vulnerability-reporting and response expectations unclear. This is a transparency gap, though it is less significant than the lack of recent maintenance.