mztest/yii2-widget-upload-oss

Release historydanger

This is the package's only release, published over nine years ago, with no releases in the last 12 months. That strongly indicates abandonment risk for a dependency receiving future changes.

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the last push occurring in December 2016. No newer activity offsets this long maintenance gap.

Package scaffoldingcaution

The artifact includes a readable README and release notes for this version, providing basic consumer documentation. The README's installation example names a different package, which reduces documentation reliability.

Repo toolingcaution

Composer is used for the build, but no security scanning tooling is configured. This is a hygiene gap, though it is secondary to the much larger maintenance concern.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented. This adds transparency risk for a package handling file uploads.