datamweb/codeigniter-dea-rule

Release historydanger

This is the only release, published nearly three years ago, with no releases in the last 12 months. That substantially raises abandonment risk despite the repository remaining available.

Lifecycle scriptscaution

The package declares a post-update command, which introduces code execution during dependency updates. No other provided signal shows that this hook is unsafe, so the concern is limited.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. This is consistent with the old release history and suggests limited ongoing maintenance.

Version stabilitycaution

Version v0.0.1 is an early, pre-1.0 release, so compatibility and project maturity are less established than for a stable-major package.

Workflow auditcaution

All 32 analyzed action references are unpinned, and the audit found a high-confidence unpinned container image in the PHPUnit workflow. The workflows have no untrusted checkout or script-injection findings, which limits the overall impact.