coduo/php-matcher

Lifecycle scriptscaution

Composer post-install and post-update scripts are present. They add installation-time behavior that consumers should understand, but this signal alone does not establish a health or abandonment problem.

Repo commit activitycaution

No commits and no active maintainers were recorded in the last three months. Although the recent release and repository push provide some counterevidence, this is a real sign that maintenance activity has slowed.

Security policycaution

The repository has no published security policy. This is a transparency gap for reporting vulnerabilities, though it does not by itself indicate abandonment.

Workflow auditcaution

All 14 analyzed action references are unpinned, and the audit found a high-confidence bot-conditions issue in the Dependabot auto-merge workflow. There are no untrusted checkouts or script-injection findings, limiting the severity to workflow hygiene concerns.