devmehq/sdk-php

Release historycaution

The package has only three releases, with the latest published over four years ago and none in the last 12 months. This is meaningful abandonment risk despite the short historical release interval.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Combined with the old registry release, this weakens confidence that defects or compatibility issues will be addressed.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. This is a modest transparency and maintenance gap, not a severe risk by itself.

Security policycaution

The repository has no security policy. That makes vulnerability reporting and response expectations less clear, though it does not by itself show unsafe code.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous findings, triggers, or write-wide permissions. However, all four action references are unpinned, leaving avoidable build-integrity risk.