wp-content-framework/update_check

Release historydanger

The package has 52 releases since February 2019, but none in the last five years; this is strong evidence of abandonment risk despite its earlier regular cadence.

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the long release gap and indicating no current maintenance activity.

Licensecaution

The artifact contains a license file, but it is detected as GPL-3.0 while the registry declares GPL-2.0+, creating an unresolved licensing mismatch rather than a missing-license gap.

Security policycaution

The linked repository has no security policy, which reduces transparency and gives maintainers no documented channel for reporting vulnerabilities.

Workflow auditcaution

All 48 action references are unpinned, one workflow uses an untrusted checkout with a pull_request_target trigger, and a high-confidence audit found an unpinned container image. The low-confidence GITHUB_ENV finding is only a hygiene concern.