php-http/cache-plugin

Repo commit activitycaution

There were no commits and no active maintainers in the last three months, which is a maintenance concern. However, the recent release and repository push provide some compensating evidence, so this is caution rather than abandonment-level risk.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. The missing scanning is a hygiene gap, not evidence that the package is unsafe or unmaintained by itself.

Workflow auditcaution

Both workflows were analyzed successfully and have no untrusted checkouts, injection findings, or broad top-level write permissions. However, the high-confidence finding that a container image is unpinned weakens build reproducibility and supply-chain hygiene.