zero-to-prod/http-router

Release historycaution

This is the package's only release, published about 270 days ago, so there is little release history to demonstrate sustained maintenance. That is a meaningful maturity concern for a dependency.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months. Combined with the single-release history, this leaves maintenance capacity unproven.

Version stabilitycaution

Version v0.1.2 is not a stable major release, which indicates an early-stage API and greater compatibility risk for adopters.

Workflow auditcaution

All seven action references are unpinned, and the audit found a high-confidence template-injection pattern twice in annotate.yml; the separate script-injection finding adds workflow hygiene risk. No untrusted checkout or dangerous trigger was reported, so this is caution rather than a standalone severe verdict.