jangregor/phpstan-prophecy

Project backingcaution

The repository is owned by an individual rather than an organization, so the single registry maintainer represents a concentrated maintenance base.

Release historycaution

The package has existed since 2017, with 24 releases and a release in the last year, but only one release in that period and a median interval of about 81 days indicate a modest cadence.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, a meaningful maintenance concern despite the recent push and other recent project activity.

Security policycaution

The repository has no security policy. This is a transparency gap, although it is partly offset by the presence of Dependabot scanning.

Workflow auditcaution

All 16 analyzed action references are unpinned, creating avoidable workflow supply-chain drift. The medium-confidence high-severity bot-conditions finding also warrants caution; the pull_request_target and workflow_run triggers had no untrusted checkout or script-injection sinks.