tourze/psr15-static-file-request-handler

Package scaffoldingcaution

Tests are present and the exact release has GitHub release notes, but the published README contains only one character, leaving consumers without meaningful package guidance.

Release historycaution

This package has only one release, 0.0.1, published about 17 months ago, with no releases in the last 12 months. That leaves limited evidence of release maturity and ongoing maintenance.

Security policycaution

The repository has no security policy. This is a transparency and maintenance gap, although it is less severe for a small package with no reported workflow audit findings.

Version stabilitycaution

Version 0.0.1 indicates an early-stage API even though it is not marked as a prerelease. The lack of a stable major version increases compatibility uncertainty.

Workflow auditcaution

Both workflows were analyzed with no injection, untrusted checkout, permission, or severity findings, and one workflow scopes read-only permissions. However, all three action references are unpinned, reducing build reproducibility and supply-chain hygiene.