wpmetabox/mb-comment-meta

Release historycaution

The package has had only two releases, with no release in the last 12 months; the latest release was about 22 months ago. This is a meaningful maintenance concern, though the package is not deprecated and remains on a stable major version.

Repo commit activitycaution

There were no commits and no active maintainers in the past three months. This supports the concern that maintenance has slowed, although the repository was pushed more recently than the package's last registry release.

Repo toolingcaution

The project uses Composer for its build process, but no security scanning tools were detected. The missing scanning is a modest transparency and hygiene gap rather than a severe dependency risk.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations unclear. This is a hygiene concern, not evidence that the package is unsafe.

Workflow auditcaution

Both analyzed workflows use unpinned actions, which weakens build reproducibility. The audit found no dangerous triggers, untrusted checkouts, script injection, or excessive top-level permissions, which limits the impact.