quartetcom/static-analysis-kit

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script. This is relevant for a Composer plugin and is not severe on its own, but it increases installation complexity and deserves review when maintenance activity is limited.

Release historycaution

The package has 44 releases since February 2023, but none in the last 12 months and the latest release was over two years ago. Earlier release activity shows maturity, but the current pause lowers confidence in ongoing maintenance.

Repo commit activitycaution

The repository had 0 commits and 0 active maintainers in the last three months, consistent with the package's extended release pause. This is a meaningful abandonment concern, though the repository is not archived.

Security policycaution

The linked repository has no security policy. This is a transparency gap, but it is partly offset by Dependabot-based security scanning and is not an abandonment verdict by itself.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, sinks, or audit findings, but all 4 action references are unpinned. That leaves avoidable build-integrity and reproducibility exposure.