bradstinson/assets

Dependency profilecaution

The package has five runtime dependencies, including asset-processing libraries and a PHP constraint. This is a meaningful integration surface for an old package, but the signal does not show that the dependencies are unsafe or unusable.

Release historycaution

The package has 11 releases but none in the last 12 months, and its latest registry release was published over 11 years ago. This is a significant maintenance concern despite the earlier short release intervals.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, consistent with no meaningful development for about six years. The repository is not archived, but that does not compensate for the prolonged inactivity.

Repo toolingcaution

Composer is used as a build tool, showing basic project tooling, but no security scanning tools are present. This is a modest transparency and maintenance gap rather than a severe risk.

Security policycaution

The repository has no security policy. For a package that processes application assets, this reduces transparency for reporting and handling vulnerabilities, though it is not by itself evidence of a vulnerability.