ray/psr7-module

Lifecycle scriptscaution

Composer post-install and post-update scripts add execution during dependency installation or updates. Their presence is a supply-chain hygiene concern, although the signal does not show that the scripts are harmful.

Release historycaution

The package has existed since 2018 and published one release in the last 12 months, but its median release interval is about 280 days, indicating a deliberately slow cadence rather than rapid maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. The January 2026 release and recent push provide some compensating evidence, but current maintenance capacity remains uncertain.

Repo toolingcaution

Composer is used for builds, but no security-scanning tool was detected. This is a modest transparency gap rather than evidence of unsafe code.

Workflow auditcaution

All three analyzed workflows use unpinned actions, which weakens build reproducibility. The audit found no dangerous triggers, untrusted checkouts, script injection, or high-confidence findings, limiting this to a hygiene concern.