cognesy/instructor-php

Dependency profilecaution

The release declares 25 runtime dependencies, a substantial integration surface that adds maintenance and transitive-dependency exposure, though the active project offsets some of that concern.

Repo bus factorcaution

Two contributors were active, but the leading contributor made about 73% of recent commits; organizational ownership provides some ability to hand work off.

Repo toolingcaution

The project uses Just and Composer for builds, but no security-scanning tools were detected, leaving a release-quality gap.

Security policycaution

No repository security policy was found, reducing transparency about vulnerability reporting and maintenance response.

Workflow auditcaution

All 28 action references are unpinned, one workflow grants top-level write permissions, and the audit found four high-confidence template-injection findings in split.yml; no untrusted trigger or checkout was detected, so this is workflow hygiene risk rather than a standalone severe dependency verdict.