zero-to-prod/validate-semver-cli
The project has a clear README, repository tests, release notes for this version, security scanning, and no install-time scripts. Its workflows need attention because all 13 actions are unpinned and one workflow contains a script-injection finding.
58%
Total Score
50
94
100
Health Score Breakdown
The package has had five releases since January 2025, but none in the last 12 months; its latest release was about one year ago. This is a meaningful maintenance concern despite the earlier short release intervals.
The repository recorded zero commits and zero active maintainers in the last three months, consistent with the package's year-long release gap. This raises abandonment risk.
All 13 analyzed action references are unpinned, and one high-confidence script-injection finding was reported in annotate.yml. The template-injection findings are hygiene concerns, while the workflow_run trigger does not share a path with the reported script-injection workflow, so this is not a severe standalone risk.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 David Smith |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 symfony/console Version ^7.2 | — | — |
zero-to-prod/data-model Version ^81.9 | — | — |
zero-to-prod/regex-semver Version ^71.1 | — | — |
zero-to-prod/package-helper Version ^1.1.3 | — | — |
zero-to-prod/validate-semver Version ^71.0 | — | — |
Weekly Downloads
Info
- Last Published
- 1 year ago
- Created
- 1 year ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.