boson-php/uri-factory-contracts

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months. For a small stable contracts package this may reflect maturity, but it still lowers confidence in ongoing maintenance.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. The missing scanning is a modest process gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy. This weakens vulnerability-reporting transparency, although the package is a small interfaces-only component.

Version stabilitycaution

Version 0.19.5 is not a prerelease, and no recent releases are prereleases. The 0.x major version still indicates API stability may be less established than in a 1.x package.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all 4 action references are unpinned, leaving a supply-chain hygiene gap.