diablomedia/zendframework1-file

Dependency profilecaution

The package declares 11 runtime dependencies, including several related Zend Framework components and required PHP extensions. This is a meaningful dependency surface, though the signal does not show an unsafe or unusually complex dependency pattern.

Release historycaution

The package has 10 releases over more than eight years, but only one release in the last 12 months and a median interval of about 326 days. That indicates a slow but not abandoned release cadence.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months. Although a recent release and repository push provide some counterevidence, the current maintenance activity is still thin.

Security policycaution

No security policy was found in the repository. That leaves vulnerability reporting and response expectations less explicit for a reusable library.

Workflow auditcaution

All five analyzed action references are unpinned, and the audit found a high-confidence bot-condition issue in the auto-merge workflow. The workflow has top-level write permissions, while no untrusted checkout or script-injection sink was found, so this is a hygiene and supply-chain caution rather than a severe standalone risk.