knplabs/knp-menu

Release historycaution

The package has 33 releases over more than 14 years, but none in the last 12 months; the latest release was about 15 months ago. This suggests slowing maintenance despite the long release history.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. That is a concrete maintenance slowdown, although the recent push evidence and published release notes provide some compensation.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. This is a modest transparency and maintenance gap, not evidence that the package is unsafe.

Security policycaution

The repository has no security policy. For a mature library this weakens vulnerability-reporting transparency, though it does not by itself indicate abandonment.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkouts or script injection, but all nine action references are unpinned and the audit found a high-confidence unpinned container image. This is a workflow reproducibility and supply-chain hygiene concern.