portphp/dbal

Release historycaution

The package has existed for over eight years and released once in the last 12 months, including the assessed release, but only three releases overall with intervals of about four years indicate a sparse cadence.

Repo bus factorcaution

All two recent commits came from one contributor, concentrating current maintenance responsibility despite the organization-owned project.

Repo commit activitycaution

There were two commits in the last three months, showing some recent maintenance but a modest activity level.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting guidance undocumented.

Workflow auditcaution

The single workflow was fully analyzed, uses read-only permissions, and has no reported dangerous sinks or audit findings. However, all three action references are unpinned, which is a workflow reproducibility and supply-chain hygiene gap.