vanilla/js-connect-php

Release historycaution

The latest release was about three years ago, and there were no releases in the last 12 months. Eight releases over the package's lifetime show some history, but the recent pause lowers maintenance confidence.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months, consistent with the roughly three-year-old latest release. This is meaningful abandonment risk for a library integrated into an application.

Security policycaution

No repository security policy was found, leaving the process for reporting vulnerabilities unclear. Psalm scanning provides some compensating security practice, so this is a limited transparency concern.

Workflow auditcaution

The single workflow was fully analyzed, uses read-only permissions, and has no untrusted checkouts or injection findings. All 6 action references are unpinned, which is a supply-chain hygiene gap but not a severe risk by itself.