affinity4/file

Clear documentation, tests, and an MIT license make integration straightforward. The single runtime dependency keeps the maintenance surface small, though the repository has no security scanning.

Latest 2.1.7

Packagist

60%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has had no registry release in about 4 years, despite 10 releases since 2017. This is a meaningful maintenance concern, although the stable 2.1.7 release and documented scope reduce the risk of immediate breakage.

Repo commit activity

The repository recorded 0 commits and 0 active maintainers in the last 3 months, consistent with the last push being about 4 years ago. That indicates inactive maintenance rather than an archived project.

Repo popularity

The repository has only 2 stars, 0 forks, and 2 watchers, so there is little visible community support or backup if issues arise. Low popularity is supporting caution, not a standalone reason to reject a small focused library.

Repo tooling

Composer build tooling is present, but no security-scanning tool was detected. Build support is positive; the missing scanning is a modest supply-chain hygiene gap.

Security policy

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented. This is a transparency gap, but it is partly offset by the package's small dependency surface.