diablomedia/zendframework1-db

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. That is a meaningful maintenance warning for a library, even though the recent release and April push provide some compensating evidence.

Security policycaution

The repository has no security policy, leaving no documented process for reporting or handling vulnerabilities. This is a transparency gap, but it is not evidence that the package is unsafe.

Workflow auditcaution

All workflows were analyzed, but five of six action references are unpinned, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. One workflow also grants top-level write permissions; without an untrusted checkout or script-injection sink, these remain workflow-hygiene concerns rather than a severe supply-chain verdict.