swoft/serialize

Release historydanger

The package has had only three releases, with the latest released about six years ago and none in the last 12 months. This is strong evidence of abandonment for a dependency that may need fixes.

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers in the last three months, reinforcing that maintenance has effectively stopped.

Repo toolingcaution

Composer is used for the build, but no security-scanning tool is present. For a small library this is a hygiene gap rather than proof of unsafe code.

Security policycaution

The linked repository has no security policy, leaving vulnerability reporting and response expectations undocumented. This is a maintenance and transparency gap, though not severe on its own.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers or audit findings, but both action references are unpinned. That weakens build reproducibility and supply-chain hygiene without showing an active exploit path.