cubicl/php-object-graph-generator

Repo bus factorcaution

All 5 commits in the last 3 months came from one contributor, leaving maintenance dependent on a single active individual. Organization ownership provides some continuity, but no second active contributor is shown.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. This is a maintenance and transparency gap rather than evidence that the package is unsafe.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented. This is a modest transparency concern for a library dependency.

Version stabilitycaution

Version 0.2.0 is not a stable major release, so API compatibility may still change. It is not marked as a prerelease, which partly offsets that concern.

Workflow auditcaution

The only workflow was fully analyzed and has no injection or high-severity findings, but both of its 2 action references are unpinned, weakening build reproducibility and trust.