psr-mock/http-client-implementation

Release historycaution

The package has only two releases, with none in the last 12 months and the latest published about two and a half years ago. This is a meaningful maintenance concern for a dependency, despite the stable 1.0.1 release.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months, consistent with the long release gap. This raises abandonment risk, although the project is small and its current scope may be stable.

Workflow auditcaution

All eight workflows use pull_request_target, but none has an untrusted checkout or script injection, so those triggers are not dangerous here. The audit found a high-confidence unpinned container image and all 21 action references are unpinned, creating a notable supply-chain hygiene gap.