soyhuce/service-provider-registrar

Release historycaution

The package has eight releases since May 2020, but none in the last two years and latest release activity is from March 2024. This is a meaningful maintenance concern for a dependency, despite its established history.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the long release gap. The project is not archived, but current maintenance capacity is not demonstrated.

Security policycaution

The repository has no published security policy. This lowers transparency and makes vulnerability reporting less clear, although it is a small package with limited runtime dependencies.

Workflow auditcaution

All eight analyzed action references are unpinned, and the audit found a high-confidence unpinned container image in php-cs-fixer.yml. There are no untrusted checkouts or script-injection findings, so this is workflow hygiene risk rather than a severe dependency risk.