roave/backward-compatibility-check

Dependency profilecaution

The release declares 24 runtime dependencies, including several libraries and extensions. This is a meaningful dependency surface to maintain, but the provided signal does not show an inherently excessive or unsafe profile.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months, which is a maintenance warning. However, the current release, recent release notes, and four merged pull requests in the last month provide partial evidence that repository work is still occurring through the measured workflow.

Repo toolingcaution

Composer is used as the build tool, but no security scanning tool was detected. The missing scanning process is a transparency and maintenance gap, though workflow analysis found no dangerous patterns.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented. This is a process gap rather than evidence that the release is unsafe.

Token permissionscaution

Both workflows lack top-level token permissions declarations, so their permissions are not explicitly constrained at workflow scope. No top-level write permissions were detected, which limits the severity of this hygiene gap.