marcelbolten/php-cairo

Release historycaution

The package is 238 days old but has only three releases, all published within about one day, so there is little evidence of a sustained release cadence.

Repo bus factorcaution

All two commits in the last three months came from one contributor, leaving maintenance dependent on a single active person despite the repository remaining active.

Security policycaution

The repository has no security policy, reducing transparency about how vulnerabilities should be reported and handled.

Workflow auditcaution

All 16 analyzed action references are unpinned, which weakens build reproducibility. The medium-confidence template-injection findings are hygiene concerns only because no untrusted checkout or dangerous workflow trigger was observed.