cline/php-cs-fixer

Dependency profilecaution

The package declares 16 runtime dependencies, including several coding-standard and analysis tools, creating a relatively broad dependency surface for a standards package.

Maintainerscaution

Only one account has registry publish access. This is a modest publishing concentration concern, reinforced by the repository's single active contributor, though access records alone do not measure maintenance.

Repo bus factorcaution

All five recent commits came from one contributor, leaving no demonstrated second active maintainer to absorb ongoing work.

Repo toolingcaution

The project uses Composer and just for builds, but no security-scanning tools were detected, leaving a security-hygiene gap.

Workflow auditcaution

The sole workflow was fully analyzed with no reported findings or untrusted-trigger sinks, but all 8 action references are unpinned, weakening build reproducibility and supply-chain protection.