open-telemetry/opentelemetry-php-contrib

Registry deprecationdanger

Packagist marks the entire package abandoned with no replacement, which directly lowers confidence in depending on this release. The package-level scope is more serious than a warning affecting only one version.

Release historydanger

The registry has published no releases in the last 12 months, and the latest release was on February 16, 2023. This indicates the released package line is stale, although recent repository activity provides partial context.

Workflow auditdanger

All 17 workflows were analyzed, but a high-confidence finding reports an app token with access to all repositories in the owner's installation. The single pull-request-target workflow has no untrusted checkout or script-injection finding, but the credential scope remains a serious automation risk.