Are slsa-github-generator and slsa-verifier still maintained?

[jkreileder]

slsa-github-generator and
slsa-verifier haven't seen substantive
updates in a while, and I'd like to understand what downstream users should plan for.

What prompts the question:

• slsa-github-generator's SECURITY.md still lists >= 2.0.x and >= 1.10.x as supported
  and receiving security updates, but the last substantive commit to main was October 2025.
  v2.1.0 (February 2025) is still the newest release.
• The most recent commit to main (#4469, March 2026) removed @slsa-framework/slsa-tool-reviewers
  from CODEOWNERS.
• Dependency refresh PR #4361 has been open since August 2025 — a full year — and issue #4490
  (node20 → node24) has had no maintainer response since April 2026.
• slsa.dev/community notes that the Tooling SIG no longer meets regularly.

I understand maintainer time is finite, and none of this is a complaint — these tools have been
valuable. But the reusable workflows run entirely on ubuntu-latest, which callers cannot pin or
override, so an unmaintained generator can break a downstream release with no warning and no fix
available. For a security-relevant tool, "quietly stops working" is a bad failure mode.

Could a maintainer clarify one of two things?

1. If the tools are still maintained: a release including the pending dependency updates would
   confirm it.
2. If they aren't: a maintenance-status notice in the READMEs would let downstream users plan a
   migration before something breaks.

Either answer is fine — what's hard is not knowing.