askonomm/siena

Dependency profiledanger

The package declares PHP, symfony/yaml, and ramsey/uuid as runtime dependencies, but the linked source tree is Rust-based. The unexplained ecosystem mismatch materially weakens publication transparency.

Package file treedanger

The linked repository contains a small Rust source tree with Cargo.toml, while the registry dependency profile declares a PHP package. This mismatch makes the published artifact and its intended build path difficult to verify.

Release historycaution

The latest release was over four years ago, and there were no releases in the last 12 months. That is a substantial abandonment concern despite the package having four historical releases.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. Combined with the lack of releases for over four years, this points to a largely inactive project.

Repo toolingcaution

The repository reports no build tooling and no security scanning tools. For a package that needs trustworthy publication, this leaves important verification and vulnerability-detection gaps.