spatie/php-cloneable

Release historycaution

Only three releases have been published since November 2021, with no releases in the last 12 months and a median interval of about 403 days; this lowers confidence in ongoing maintenance.

Repo commit activitycaution

There were no commits or active maintainers in the last three months. This may reflect a small, stable package, but it still leaves current maintenance capacity uncertain.

Security policycaution

No repository security policy was found. This is a transparency gap, though the package is small and has Psalm scanning, which partly reduces the concern.

Workflow auditcaution

All four workflows were analyzed without untrusted checkouts or script injection, but the audit found a high-confidence unpinned container image and all 11 action references are unpinned. This is a supply-chain hygiene concern, not evidence that the release is unsafe by itself.