ankitpokhrel/tus-php

Project backingcaution

The registry namespace and repository are owned by the same individual, so the package has direct ownership alignment, but it does not have organization backing that would broaden maintainer capacity.

Release historycaution

The package has 26 releases over roughly eight years, but it has had no registry release in the last 12 months; this indicates a meaningful maintenance slowdown for a dependency with ongoing compatibility needs.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers during the last three months. That recent inactivity raises abandonment and delayed-fix risk, though the existing release history and non-archived state provide some context.

Workflow auditcaution

All workflows were analyzed without untrusted triggers or script-injection findings, but the audit found a high-confidence unpinned container image and all four action references are unpinned. This weakens CI supply-chain reproducibility, although it is not an immediate dependency verdict on its own.