rebelcode/event-state-machine

Release historydanger

Only two releases were published, with none in the last 12 months; the latest release was about eight years ago. This is strong evidence of abandonment risk despite the package not being deprecated.

Repo commit activitydanger

There were no commits and no active maintainers in the last three months, with the last repository push about eight years ago. This materially increases abandonment and unresolved compatibility risk.

Dependency profilecaution

Nine runtime dependencies create a relatively broad compatibility surface for a small package, increasing the maintenance burden when the project is no longer actively updated.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. That is a modest transparency and maintenance gap, not a standalone reason to reject the package.

Security policycaution

The repository has no security policy, leaving no documented path for reporting vulnerabilities. This is a hygiene gap that matters more because maintenance activity appears to have stopped.