rezaur/skeleton

Release historydanger

The package has only two releases, with the latest published in June 2017 and none in the last 12 months. That is strong evidence of abandonment for a dependency expected to remain compatible with its ecosystem.

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the last release being over nine years ago. No provided activity signal compensates for this absence.

Dependency profilecaution

The package declares 16 runtime dependencies, including framework, ORM, security, and API components. That broad surface increases compatibility and maintenance exposure when the package has not been updated for over nine years.

Lifecycle scriptscaution

post-install-cmd and post-update-cmd scripts run during dependency installation and updates, adding execution and reproducibility risk. Their presence is not severe by itself, but it increases the cost of adopting an otherwise inactive package.

Package file treecaution

Both the published artifact and linked repository contain only composer.json, leaving little visible source or project context for a package with 16 runtime dependencies. This materially limits transparency.