silasjoisten/sonata-oauth2-login-bundle

Release historydanger

The package has 20 releases over roughly nine years, but none in the last 12 months and the latest release was about three years ago. This is strong evidence of stalled maintenance for a library dependency.

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the long release gap. No provided activity signal compensates for this lack of recent development.

Workflow auditdanger

All 16 analyzed action references are unpinned, and the audit reports two high-confidence bot-condition findings in the PHP workflow. The workflows avoid untrusted checkouts and script injection, but these remaining issues weaken build provenance.

Maintainerscaution

Only one registry account has publish access. The repository is user-owned rather than organization-backed, so there is little visible redundancy if that maintainer becomes unavailable.

Security policycaution

The repository has no security policy, which reduces transparency for reporting and handling vulnerabilities. The presence of Dependabot provides some compensating maintenance tooling but does not replace a policy.