api-clients/psr7-oauth1

Lifecycle scriptscaution

The package declares post-install and post-update Composer scripts. These can be legitimate project automation, but they add install-time execution surface and warrant caution when depending on the package.

Release historycaution

Only three releases exist since November 2016, with the latest published in May 2021 and no releases in the last 12 months. This long release gap raises abandonment risk.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Although the repository is not archived, the recent lack of activity weakens maintenance confidence.

Security policycaution

The repository has no security policy. This is a transparency and vulnerability-reporting gap, though Dependabot scanning provides some compensating security tooling.

Workflow auditcaution

All 26 analyzed action references are unpinned, which weakens build reproducibility, and the audit found a medium-confidence template-injection pattern. No untrusted checkout, script injection, dangerous trigger, or broad top-level write permission was observed, so this is a hygiene concern rather than a severe workflow risk.