pugx/shortid-php

Release historycaution

The package has existed for about 10.5 years with 15 releases, but only one release in the last 12 months and a median interval of about 9 months indicate a modest cadence.

Repo bus factorcaution

All two recent commits came from one contributor, concentrating current maintenance activity; organizational ownership partly offsets the handoff risk but does not remove it.

Repo commit activitycaution

The repository had two commits in the last 3 months, demonstrating recent maintenance but at a low pace.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting expectations unclear.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkout or script-injection findings, but both high-confidence findings concern unpinned container images and all six action references are unpinned. The missing top-level permissions block is acceptable on its own because the workflow has no top-level write permissions.