diablomedia/zf2-oauth2-server

Release historycaution

The latest release was published over two years ago, with no releases in the last 12 months and only six releases over roughly 12 years. This indicates slow maintenance and lowers confidence in continued support.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months. Combined with the old latest release, this points to a currently inactive project.

Repository archivedcaution

The linked repository is not archived, although its last push was over two years ago. The active repository status is positive, while the old push date is consistent with the maintenance concern shown by release history.

Security policycaution

The repository has no security policy file. For an OAuth2 server integration, the absence of a documented vulnerability-reporting process is a meaningful transparency gap.

Workflow auditcaution

All four action references are unpinned, and the audit found a high-confidence bot-conditions issue in the Dependabot auto-merge workflow. The workflows were fully analyzed and have no untrusted checkouts or script injection, so this is a hygiene concern rather than a severe standalone risk.