aksafan/yii2-fcm-both-api

Maintainerscaution

Only one registry account has publish access. The matching user-owned repository provides some continuity, but the single publisher still creates a limited release bus factor.

Release historycaution

The package has existed for about 7 years and 11 months, but has only nine releases overall and one release in the last 12 months. That is usable but indicates a slow maintenance cadence.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. With only one registry release in the last year, this is the clearest evidence of currently thin maintenance.

Repo toolingcaution

Composer is used for the build, but no security scanning tools are configured. The missing scanning reduces supply-chain transparency, though it is not by itself evidence that the package is unsafe.

Security policycaution

The repository has no security policy. For a package handling Firebase authentication and push notifications, the lack of a documented vulnerability-reporting process is a transparency gap.