fabiang/doctrine-dynamic

Project backingcaution

The package and repository are owned by the same individual account, so the source ownership is coherent, but there is no organization backing shown to broaden maintenance capacity.

Release historycaution

The package has existed since 2016 but has only six releases, with no release in the last 12 months and the latest release on November 26, 2024. This indicates slow maintenance for a library that may need compatibility updates.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. Combined with the absence of releases in the last year, this is evidence of slowed or paused maintenance.

Security policycaution

The repository has no published security policy. This is a transparency gap for reporting and handling vulnerabilities, though it does not by itself show that the code is unsafe.

Workflow auditcaution

The only workflow was fully analyzed with no untrusted checkout or script-injection findings, but all nine action references are unpinned and the audit found a high-confidence unpinned container image. This is a real build-reproducibility and workflow-hygiene concern.