pashamesh/psb-acquiring-php-sdk

Maintainerscaution

One registry maintainer is a thin publishing base for a user-owned project, increasing continuity risk if that person stops maintaining it. The repository’s tests and recent release evidence provide some compensating maturity.

Release historycaution

The package has six releases since February 2023 but none in the last 12 months, despite a median interval of about 18 days earlier in its history. This recent pause lowers confidence in continued maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers during the last three months, consistent with the long release gap. This is a meaningful abandonment concern, though the repository is not archived.

Security policycaution

The repository has no security policy, leaving no documented process for reporting or handling vulnerabilities. This is a transparency and maintenance gap for a payment-acquiring SDK.

Workflow auditcaution

Both workflows were analyzed successfully and have no untrusted checkouts or script injection, but all nine action references are unpinned and the audit found a high-confidence unpinned container image. This weakens build reproducibility and workflow supply-chain hygiene.