petert82/monolog-logfmt

Project backingcaution

The package and repository are owned by the same individual account. That is coherent ownership, though it does not provide the redundancy of organization backing.

Release historycaution

The package has existed since 2017 and has seven releases, but it had no releases in the last 12 months and its median release interval is about 389 days. This supports a stable, slow-moving project but lowers confidence in active maintenance.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months. The recent repository push is compensating evidence, but the current inactivity still creates a modest abandonment concern.

Security policycaution

The repository has no security policy. For a small formatter this is a transparency gap rather than a severe dependency risk, but it provides no documented vulnerability-reporting path.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkouts, script injection, or audit findings, and it has no top-level write permissions. However, all four action references are unpinned, leaving avoidable build-integrity risk.