slam/phpstan-laminas-framework

Project backingcaution

The repository is owned by a user account rather than an organization, so the three registry maintainers provide some publishing capacity but not strong institutional backing. This modestly limits confidence in long-term continuity.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers during the last three months. This is a meaningful maintenance warning, though the recent release and September push show the project is not clearly abandoned.

Repo toolingcaution

The project uses Composer and Make, but no security-scanning tools were detected. For a small PHPStan extension this is a hygiene gap rather than evidence of immediate unfitness.

Security policycaution

The repository has no security policy. That weakens vulnerability-reporting transparency, but it is a moderate governance gap rather than a standalone dependency risk.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkouts, script injections, or audit findings, but all 15 action references are unpinned. The missing top-level permissions block is acceptable on its own; unpinned actions remain a supply-chain hygiene concern.