ray/http-message

Lifecycle scriptscaution

The package defines post-install and post-update Composer scripts, which create install-time execution surface. No provided signal shows those scripts are harmful, so this is a modest supply-chain caution rather than a severe finding.

Release historycaution

The package has existed for about 7 years and 9 months, with its latest release on January 28, 2026. Only one release occurred in the last 12 months and the median interval is about 9 months, indicating established but infrequent maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers during the last 3 months. That is a meaningful maintenance warning, although it is partly offset by the release pushed at the start of the period.

Repo popularitycaution

The repository has 0 stars, 1 fork, and 2 watchers, showing a very small adoption footprint. Popularity is supporting evidence rather than a verdict, but this provides little independent evidence of maturity.

Workflow auditcaution

All 3 workflows were analyzed successfully with no detected injection sinks or high-severity findings, but all 3 action references are unpinned. The unpinned references weaken build reproducibility and supply-chain hygiene without making the release unfit on their own.