roach-php/core

Lifecycle scriptscaution

Composer post-install and post-update scripts run during dependency operations, increasing the amount of package code executed automatically. This is a modest supply-chain hygiene concern, not evidence that the release is unsafe by itself.

Release historycaution

The package has 14 releases over roughly 4 years, but none in the last 12 months; the latest registry release was about 18 months ago. This indicates a meaningful maintenance slowdown, though the release history is not otherwise immature.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers over the last three months. Combined with the lack of releases in the last year, this raises abandonment risk.

Repo issue activitycaution

There were no new or closed issues and no merged pull requests in the last month, while 18 issues and 15 pull requests remain open. This suggests limited recent project activity.

Security policycaution

The repository has no security policy. This weakens vulnerability-reporting transparency, although Dependabot and the visible project structure provide some compensating process evidence.