yard/logger

Release historycaution

Only two releases exist, with the latest published over a year ago and no releases in the last 12 months. That weakens evidence of sustained maintenance, although the repository shows more recent activity elsewhere.

Repo commit activitycaution

There were no commits and no active maintainers in the three months measured. This is a meaningful maintenance warning, though the recent repository push provides some counterevidence.

Security policycaution

No security policy is present in the repository. For a small logger this is a transparency gap, but it is not as serious as missing tests or abandoned source code.

Workflow auditcaution

All seven analyzed action references are unpinned, and every workflow inherits secrets; one workflow also grants top-level write permission. No untrusted checkout or script-injection path was found, so this is a hygiene concern rather than a severe workflow risk.