friends-of-behat/variadic-extension

Release historycaution

The package has existed for about 10 years with 9 releases, but only 1 release in the last 12 months and a median interval of about 365 days indicate a slow maintenance cadence.

Repo commit activitycaution

There were no commits and no active maintainers in the last 3 months. The March 23 release provides some recent evidence, but the current quiet period still modestly raises abandonment risk.

Repo toolingcaution

The repository uses Composer for builds, but no security scanning tool was detected, leaving a minor assurance gap.

Security policycaution

No security policy was found in the repository, reducing transparency for reporting vulnerabilities, though this small extension is not otherwise shown to be unmaintained.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkouts, script injection, or audit findings. Both action references are unpinned, which is a minor supply-chain hygiene gap, while the absence of a top-level permissions block is acceptable on its own.