php-architecture-kit/domain-core

Release historycaution

The package is only 155 days old and has released twice, with a median interval of about 156 days. The latest release is current, but the short history provides limited evidence of sustained maintenance.

Repo commit activitycaution

There were no commits and no active maintainers in the last 3 months. Although two pull requests were merged during the last month and a release was published, the direct commit inactivity weakens confidence in ongoing maintenance.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. This is a modest transparency and maintenance gap rather than evidence of an unsafe package.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

The single workflow was fully analyzed with no injection or high-severity findings, but all 9 of 9 action references are unpinned. The lack of a top-level permissions block is acceptable here because the workflow has no top-level write permissions.