zenstruck/collection

Release historycaution

The package has existed for about 3 years and 4 months with 10 releases, but only 1 release in the last 12 months and a median interval of about 138 days indicate a modest cadence.

Repo bus factorcaution

All 26 recent commits came from one contributor, so maintenance continuity depends heavily on that person; organization ownership provides some handoff capacity but does not remove the concentration risk.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool is reported, leaving a repository hygiene gap.

Version stabilitycaution

Version 0.8.0 is not a stable major release, although it is not marked as a prerelease and recent releases contain no prerelease versions.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all 6 action references are unpinned, which weakens build reproducibility and supply-chain control.