nimut/phpunit-merger

Release historycaution

The package has 15 releases since December 2017, but none in the last 12 months; its latest release was over two years ago. This indicates materially slowed maintenance despite a substantial release history.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months, consistent with the package's broader lack of recent releases and raising abandonment concerns.

Security policycaution

The repository has no security policy and no documented security contact or process, leaving vulnerability handling less transparent.

Workflow auditcaution

All 11 analyzed action references are unpinned, weakening build reproducibility. The audit also found medium-confidence template-injection warnings, but no untrusted checkout or script-injection path, so these are workflow hygiene concerns rather than a severe standalone risk.