loophp/service-alias-autoregister-bundle

Release historycaution

The package has had only 3 releases, with none in the last 12 months; the latest release was in May 2023. This is meaningful evidence of slowing maintenance, though the repository remains active enough to avoid treating the package as abandoned outright.

Repo commit activitycaution

There were 0 commits and 0 active maintainers in the last 3 months. This indicates limited recent development capacity, even though the repository is not archived.

Repo issue activitycaution

There were no new or closed issues or pull requests in the last month, with 8 open pull requests and 1 open issue. This suggests low current project activity and unresolved maintenance work.

Security policycaution

The repository has no security policy. This is a transparency gap, but it is less serious because the project does use Dependabot and Psalm.

Workflow auditcaution

All 6 workflows were analyzed and no untrusted checkout or script-injection paths were found, but 11 of 17 action references are unpinned and a high-confidence medium-severity archived action was found in release.yaml. The absence of top-level permissions blocks is acceptable on its own and no workflow has top-level write permissions.