xendit/xendit-php

Release historycaution

The package has 63 releases over more than 10 years, but none in the last 12 months; the latest release was about 16 months ago. This is meaningful evidence of slowing maintenance despite a historically regular cadence.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Combined with no registry releases in the last year, this raises concern that maintenance capacity has slowed.

Security policycaution

The repository has no security policy. This is a transparency gap for a payment SDK, although Dependabot scanning provides partial security-process coverage.

Workflow auditcaution

All five action references are unpinned, and the audit found high-confidence template-injection and medium-confidence archived-action findings. No untrusted checkout or dangerous workflow trigger was reported, so this is workflow hygiene risk rather than a severe dependency verdict.