diablomedia/zendframework1-validate-file

Release historycaution

The package has existed since 2018 with 10 releases and one release in the last 12 months; the roughly 315-day median interval indicates slow maintenance rather than rapid development. The latest release is recent enough to offset a stronger abandonment concern.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last three months, which raises maintenance and abandonment concerns. The recent release and repository push show the project is not clearly abandoned, but ongoing activity remains limited.

Security policycaution

The linked repository has no security policy, leaving vulnerability-reporting and response expectations undocumented. Dependabot scanning and the tested repository provide some compensating project hygiene, but not a published response process.

Workflow auditcaution

All 5 analyzed action references are unpinned, and the audit found a high-confidence bot-conditions issue; one workflow also grants top-level write access. No untrusted checkout or script-injection path was found, limiting this to workflow hygiene and supply-chain caution.