zaslat/qr-invoice

Release historycaution

The package has five releases since January 2016, but its latest release was in July 2023 and it had no releases in the following 12 months. This is a meaningful sign of slow maintenance for a dependency receiving ongoing use.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months, consistent with maintenance having stopped after July 2023. This is the main reason to treat the package cautiously.

Repo toolingcaution

Composer is used as a build tool, but no security-scanning tools are present. The missing scanning is a hygiene gap, not by itself evidence that the package is unsafe to depend on.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations unclear. This is a transparency gap, although the package is not otherwise shown to have a security defect.