fragotesac/zf1-validate

Release historydanger

This is the package's only release, published about two years ago, with no releases in the last 12 months. That leaves little evidence of ongoing maintenance for a dependency.

Repo commit activitydanger

The repository recorded no commits and no active maintainers in the last three months. Although a stable legacy component may need few changes, this provides weak evidence of current maintenance capacity.

Repo popularitycaution

The repository has zero stars, forks, and watchers. Popularity is only supporting evidence, so this modestly reinforces the limited signs of adoption but does not determine the verdict.

Security policycaution

The linked repository has no security policy. That reduces transparency around vulnerability reporting, although the repository does use Dependabot for security scanning.

Workflow auditcaution

All five analyzed action uses are unpinned, and the audit reports a high-confidence bot-condition issue in the auto-merge workflow. There are no untrusted checkouts or script-injection findings, so this is a hygiene and workflow-integrity concern rather than a severe standalone risk.