spraed/pdf-generator-bundle

Project backingcaution

The repository is owned by an individual account rather than an organization, so the small registry maintainer list is not clearly backed by a larger project team. The package nevertheless has a named team and recent release history.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months. This is a meaningful maintenance concern, although the recent release indicates the project has not completely stopped publishing.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. That leaves an avoidable gap in repository hygiene.

Security policycaution

The repository has no security policy. This weakens vulnerability-reporting transparency for a package that processes generated documents and depends on a bundled Java component.

Workflow auditcaution

The sole workflow was fully analyzed with no dangerous triggers or audit findings, but all 3 of 3 action references are unpinned. The missing top-level permissions block is acceptable on its own, while unpinned actions remain a supply-chain hygiene gap.