sheng/yiicms

Lifecycle scriptscaution

A post-create-project-cmd script runs during installation. This can be normal for a Composer application template, but its behavior should be understood because it executes automatically.

Release historycaution

There have been no registry releases in the last 12 months, and the latest release was about 3 years ago. Recent repository activity partly offsets the stale published artifact, but does not remove release lag.

Repo bus factorcaution

All 26 recent commits came from one contributor, leaving maintenance dependent on a single active person.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool is reported. The missing scanning is a modest transparency gap rather than evidence of an unsafe release.

Security policycaution

No repository security policy is reported, leaving vulnerability reporting and response expectations undocumented.