symplify/vendor-patches

Repo commit activitycaution

Only one commit was recorded in the last 3 months, which is a weak recent maintenance signal despite the separate release and pull-request activity.

Repo toolingcaution

The project uses Composer for builds but reports no security scanning tooling, leaving a modest transparency and supply-chain hygiene gap.

Security policycaution

The repository has no security policy, so vulnerability reporting and response expectations are not documented.

Workflow auditcaution

All three workflows were analyzed without dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all seven action references are unpinned, weakening build reproducibility and action-integrity protection.