phlib/config

Release historycaution

This is a mature package released eight times since 2015, but it has had no registry release in the last 12 months after its January 2025 release. That points to slowing maintenance rather than abandonment by itself.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, so current maintenance capacity is not demonstrated. The recent 3.0.0 release and non-archived repository provide some counterweight.

Repo toolingcaution

The repository uses Composer build tooling, but no security-scanning tools were detected. This modestly reduces assurance while the package's tests and clean workflow audit provide partial compensation.

Security policycaution

No repository security policy was found, which weakens vulnerability-reporting transparency. This is a hygiene concern rather than evidence that the package is unsafe.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers or audit findings, but all four action references are unpinned. This is a reproducibility and supply-chain hygiene gap, not a severe risk on its own.