hetzner-cloud-php/client

Release historydanger

The package has had no release in the last 12 months, despite six releases concentrated around its January 2025 launch. This is a meaningful maintenance concern for a pre-1.0 API client.

Repo commit activitydanger

There were zero commits and zero active maintainers in the last three months. Combined with no registry releases in the last year, this is strong evidence of stalled maintenance.

Security policycaution

The repository has no security policy. For an API client, this weakens vulnerability-reporting transparency, although Dependabot provides some compensating security tooling.

Version stabilitycaution

Version 0.1.5 is not a stable-major release, so its API may still change. The release is not marked prerelease, which partly offsets the concern but does not remove its early-maturity risk.

Workflow auditcaution

All 11 action references are unpinned, three workflows grant top-level write permissions, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, so this is a hygiene and workflow-integrity concern rather than a severe standalone risk.