soyhuce/phpinsights-formatter

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers during the last three months, a concrete sign that maintenance may have stalled despite the repository not being archived.

Dangerous workflowscaution

One workflow uses pull_request_target for Dependabot auto-merge, which warrants review because that trigger can run with elevated repository context; no untrusted checkout or script-injection findings were detected.

Release historycaution

Although the package released regularly at first, its latest registry release was nearly three years ago and it has had no releases in the last 12 months, which raises maintenance and compatibility concerns.

Repo issue activitycaution

There are no open issues and four open pull requests, but none were merged or newly created in the last month, suggesting limited recent project activity.

Token permissionscaution

Four of five workflows omit top-level permissions and the Dependabot auto-merge workflow grants write access, leaving workflow token scope less explicit than ideal.