nekofar/dev-tools

Dependency profilecaution

The release declares 18 runtime dependencies, including development and analysis tools such as PHPUnit, Psalm, PHPStan, and PHP-CS-Fixer, with no separate development dependencies. This is an unusually broad runtime dependency surface for a development-tools package.

Release historycaution

The package has 51 releases since September 2021, but none in the last 12 months and the latest registry release was in February 2024. This materially raises staleness risk despite its previously regular release cadence.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months. Its later push history and unarchived status provide some context, but do not show current development activity.

Workflow auditcaution

All five analyzed workflow action references are unpinned, weakening build reproducibility. The low-confidence cache-poisoning finding is hygiene evidence only, with no untrusted trigger or checkout sink reported.