diablomedia/zendframework1-uri

Release historycaution

The package is mature, with releases since 2018 and one release in the last 12 months, but its median release interval is about 318 days. The recent release provides some evidence of continued maintenance, so this is only a mild concern.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. The recent release and April push partly compensate, but the current lack of development activity raises abandonment risk.

Security policycaution

The repository has no security policy. That weakens disclosure transparency, although the available tooling and small project scope provide some compensating context.

Workflow auditcaution

All five action references are unpinned, and the audit found a high-confidence bot-conditions issue in the Dependabot auto-merge workflow; one workflow also grants top-level write access. The workflows were fully analyzed and had no untrusted checkouts or script injection, limiting this to caution.