checkmango/php-sdk

Dependency profilecaution

The package declares 12 runtime dependencies, including several HTTP and PSR abstraction packages. This is a moderate dependency surface that adds some update and compatibility burden but is not excessive for an HTTP SDK.

Release historycaution

The package is about 4 years old but has only 3 releases, with a typical gap of about 2 years between releases and just 1 release in the last 12 months. The current release is recent, but the long-term cadence suggests limited maintenance capacity.

Repo commit activitycaution

There were 0 commits and 0 active maintainers in the last 3 months. Although the repository was pushed recently and this release is current, the measured short-term activity provides little evidence of sustained ongoing maintenance.

Repo toolingcaution

Composer is used for builds, but no repository security scanning tools were detected. The missing scanning coverage is a modest transparency gap rather than evidence of unsafe code.

Workflow auditcaution

All 3 workflows were analyzed without audit findings or untrusted checkouts, and one uses read-only permissions. However, all 4 analyzed action references are unpinned, weakening build reproducibility and supply-chain protection.