Just asking because we get a lot of its transitive dependencies flagged as vulnerable, and haven't seen an update in the project in 4 years.