spatie/shiki-php

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers during the last three months. Although a release was published recently, this quiet activity lowers confidence in near-term maintenance.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. This is a modest transparency and maintenance-process gap rather than evidence of an unsafe release.

Security policycaution

The repository has no security policy. That leaves vulnerability-reporting expectations unclear, although it does not by itself indicate abandonment.

Workflow auditcaution

All eight analyzed action references are unpinned, and the auditor found a high-confidence, high-severity unpinned container image in php-cs-fixer.yml. The workflows were fully analyzed and had no untrusted checkouts or script-injection findings, which limits the concern to workflow supply-chain hygiene.