denisyukphp/tmpfile-manager

Dependency profilecaution

Seven runtime dependencies, including Symfony components and a related package, create a meaningful dependency surface. The profile is not inherently excessive for a PHP temporary-file manager, but it increases transitive maintenance exposure.

Maintainerscaution

Only one account has registry publishing access. Because the repository is user-owned, this is a real bus-factor concern rather than normal organization publishing hygiene, although recent release activity shows the maintainer is still active.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. A release today provides some counterevidence, but the recent source activity still raises a maintenance-continuity concern.

Security policycaution

The repository has no security policy. For a library handling temporary files, the absence reduces transparency about vulnerability reporting and response expectations.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injections, or audit findings, and it does not grant top-level write access. However, all 15 action references are unpinned, leaving workflow dependencies exposed to unexpected upstream changes.