popphp/popcorn

Package scaffoldingdanger

The release notes and README explicitly mark version 4.1.5 as end-of-life and direct users to migrate to the core Pop PHP v5 application; repository tests and release notes improve transparency but do not offset the maintenance cutoff.

Repo bus factorcaution

All recent commits came from one contributor. Organization backing provides some handoff capacity, but no second active contributor is shown.

Repo commit activitycaution

Only 2 commits were recorded in the last 3 months, showing minimal ongoing activity for a framework component.

Security policycaution

The linked repository has no security policy, leaving vulnerability-reporting expectations undocumented.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers or audit findings, but all 3 action references are unpinned, weakening build reproducibility.