php-http/httplug

Release historycaution

The package has been maintained since 2015 with 14 releases, but it has had no release in nearly two years. That slows confidence in ongoing maintenance for a dependency.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months. Although the repository was pushed in December 2025 and the package is mature, the recent inactivity raises abandonment risk.

Repo issue activitycaution

Only one issue and one pull request are open, with no new or closed items in the last month. This is not a severe concern for a mature, stable package, but it offers little evidence of active current development.

Repo toolingcaution

Composer is used for builds, but no security scanning tools were detected. The missing scanning is a transparency gap, though it is not by itself evidence that the package is unsafe.

Token permissionscaution

Both workflows lack top-level token permissions declarations. No workflow requests top-level write access, but explicitly limiting permissions would provide stronger CI security hygiene.