diablomedia/zendframework1-view-helper-baseurl

Release historycaution

The package has existed since March 2018 and received a release in January 2026, but only one release was published in the last 12 months and the median interval is about 315 days. This indicates slow, not abandoned, maintenance.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months. For a small component this is a meaningful maintenance concern, though the recent release and unarchived repository partly compensate.

Security policycaution

The repository has no security policy. This is a transparency gap, although the package is small and other repository metadata is available.

Workflow auditcaution

All five analyzed action references are unpinned, one workflow grants top-level write permissions, and a high-confidence bot-conditions finding reports spoofable actor context in the Dependabot auto-merge workflow. The workflows were fully analyzed and no untrusted checkout or script injection was found, limiting the impact to a caution rather than a severe risk.