hks-systeme/php-cs-fixer-config

Release historycaution

The latest release was published about four and a half years ago, with no releases in the last 12 months. Recent repository activity partly offsets the stale package cadence, but consumers would be relying on an old release line.

Repo commit activitycaution

There were no commits and no active maintainers in the three months measured. This weakens evidence of ongoing maintenance, although recent pull-request activity and a recent push provide some contrary evidence.

Security policycaution

No repository security policy was found. This is a transparency gap, though it is less significant for a small developer tooling configuration package than for security-sensitive software.

Workflow auditcaution

All 41 analyzed action references are unpinned, which weakens build reproducibility. The audit also found a medium-confidence, high-severity bot-condition issue in merge.yaml; the pull_request_target and workflow_run triggers had no untrusted checkout or script-injection sinks, so this is a meaningful hygiene risk rather than an automatic release blocker.