ory/hydra-client

Release historycaution

The package has existed for about 6 years and has 47 releases, with 2 releases in the last 12 months. This shows continuity, though the recent cadence is slower than its historical median of about 14 days.

Repo bus factorcaution

All recent commits came from one contributor, creating a thin operational base. Organization ownership provides some handoff capacity, but no second active contributor is shown.

Repo commit activitycaution

Only 2 commits were made in the last 3 months, by 1 active maintainer. This is limited activity for a maintained SDK, although the recent push shows it has not been abandoned.

Repo toolingcaution

Composer is used for builds, but no security-scanning tool was detected. The missing scanner is a modest transparency and assurance gap rather than evidence of unsafe code.

Workflow auditcaution

All 12 analyzed action references are unpinned, which weakens build reproducibility. The pull_request_target workflow has no untrusted checkout or script-injection sink, and the audit found no high- or medium-severity issues.