wyrihaximus/react-http-middleware-twig

Release historydanger

The package has had only two releases, with the latest in June 2020 and none in the last six years. The repository is not archived, but the long release gap creates substantial abandonment risk for a dependency.

Lifecycle scriptscaution

The package runs post-install and post-update Composer scripts, which expand installation behavior and deserve scrutiny when depending on a package. No provided signal shows these scripts are harmful, so this is a limited concern.

Repo commit activitycaution

There were no commits or active maintainers in the last three months, despite a recent repository push recorded by the archive signal. This provides weak evidence of ongoing development and lowers maintenance confidence.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations unclear. This is a transparency gap, though dependency scanning provides some compensating project hygiene.

Workflow auditcaution

All 23 analyzed action references are unpinned, and the audit found a medium-confidence template-injection issue; however, there are no untrusted checkouts or dangerous workflow triggers, so this is workflow hygiene risk rather than a severe finding.