resvg-php/resvg

Project backingcaution

The repository is owned by an individual user rather than an organization, so the single-contributor concentration represents a genuine continuity risk.

Release historycaution

The package is only 4 days old with 4 releases and a median interval of about 18 hours. That shows active initial development but not yet a mature release history.

Repo bus factorcaution

One contributor made all 47 recent commits, so maintenance depends entirely on a single person and has no demonstrated handoff capacity.

Version stabilitycaution

v0.3.0 is not a stable major release, although it is not marked as a prerelease. The version therefore signals an evolving API rather than established maturity.

Workflow auditcaution

Both workflows were analyzed and use read-only permissions, with no untrusted checkout or script-injection trigger detected. However, all 53 action references are unpinned, and the high-confidence template-injection finding in release.yml is a workflow hygiene risk; the low-confidence cache-poisoning findings are not independently decisive.