yzh52521/think-geoip

Licensecaution

The manifest declares a proprietary license, with no detected license text or license file. That may restrict dependable reuse and is a meaningful transparency concern for an open-source dependency.

Release historycaution

The package has six releases, but its latest release was on February 9, 2023, with no releases in the last 12 months. The earlier roughly 22-day median interval shows an initial release history but does not offset the long current gap.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the package having received no updates since February 2023. The repository is not archived, which is a limited compensating signal but does not show active maintenance.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools are configured. That weakens automated oversight, although it is not evidence of a defect in the release itself.

Security policycaution

The linked repository has no security policy, so there is no documented process for reporting or handling vulnerabilities. This is a transparency gap for a package that queries external GeoIP services.