app-verk/php-matcher

Dependency profilecaution

The package declares eight runtime dependencies, including several libraries and PHPUnit. This is a moderate dependency surface that increases maintenance exposure compared with a narrowly scoped library.

Lifecycle scriptscaution

Composer post-install and post-update scripts run during dependency operations, adding execution and review overhead for consumers even though no malicious conclusion follows from this signal alone.

Release historycaution

The package has four releases over 656 days, but only one release in the last 12 months; the latest release was about 9 months ago. This suggests slower maintenance, though releases have continued.

Repo commit activitycaution

There were no commits and no active maintainers in the last 3 months. Combined with only one release in the last year, this is evidence of slowed maintenance.

Repo toolingcaution

Composer is used for builds, but no security scanning tool was detected. The missing scanner is a modest transparency and hygiene gap, not evidence that the package is unsafe.