aki/yii2-bot-telegram

The package has a clear README, release notes for this version, a matching repository, and an explicit LGPL-3.0+ license. Its small single-user project has no security policy or security scanning, so future support and review capacity are limited.

Latest 3.1.10

Packagist

63%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Maintainers

Only one registry account has publish access. That indicates limited publishing capacity, although the linked repository is also owned by an individual, so this is not an unexpected organization-backed project gap.

Release history

The package has 32 releases over more than 10 years, but none in the last 12 months and the latest registry release was nearly 2 years and 8 months ago. Its long history is reassuring, but current maintenance appears stalled.

Repo commit activity

The repository recorded 0 commits and 0 active maintainers in the last 3 months, consistent with a project that is no longer actively maintained. This is the strongest adoption concern despite the repository not being archived.

Repo tooling

Composer build tooling is present, but no security-scanning tools were detected. The missing scanning reduces maintenance hygiene modestly, without proving the package is unsafe.

Security policy

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented. This is a transparency gap for a package that handles Telegram API integration.