oihana/php-validation

Dependency profilecaution

The package declares 11 runtime dependencies, including several related Oihana components and Somnambulist Validation. This is a meaningful dependency surface but is coherent with a feature-rich validation library.

Lifecycle scriptscaution

post-install-cmd and post-update-cmd scripts run during Composer operations. These add supply-chain exposure and deserve review, although the signal does not show that they are malicious.

Release historycaution

This is a young package, released once 90 days ago with no subsequent release. That limited history makes long-term maintenance less proven.

Repo bus factorcaution

All seven recent commits came from one contributor, leaving maintenance concentrated in a single person. Organization ownership provides some handoff capacity, but no second active contributor is shown.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. The missing scanning is a modest transparency and maintenance gap rather than evidence of compromise.