php-win-ext/sync

Release historycaution

Only one release exists, published about 209 days ago, so there is little release history to demonstrate sustained maintenance. The release is recent enough that this is a caution rather than abandonment evidence.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. With only one release, there is not enough observed activity to establish an ongoing maintenance pattern.

Repo toolingcaution

The repository uses Composer build tooling, but no security-scanning tools were detected. Build tooling supports reproducibility, while the missing scanning is a modest hygiene gap.

Security policycaution

No security policy was found in the repository, leaving vulnerability-reporting expectations unclear. This is a transparency gap, not evidence that the package is unsafe.

Workflow auditcaution

The single analyzed workflow has top-level write permissions and all 5 of 5 action references are unpinned. No untrusted checkout, script injection, or high-confidence audit finding was reported, so this is workflow hygiene caution rather than a severe risk.