aloware/signalwire

This release appears suitable to depend on from a supply-chain health perspective: it has a long release history, a stable non-prerelease version, recent releases, an active non-archived repository, organization backing, matching repository identity, tests, changelog, licensing, build tooling, and security scanning. Recent repository activity is modest but includes two commits from two contributors and two merged pull requests, which reduces bus-factor concern. The main reservations are the repository's lack of a security policy, the workflow's absence of top-level token permissions, and very low public popularity; these are meaningful transparency and governance gaps, but they are not outweighed by evidence of abandonment or severe release risk.

Latest v4.0.0Packagist

Health Score Breakdown

Repo popularitycaution

The repository has zero stars, forks, and watchers, indicating little visible community adoption or independent validation. Popularity is supporting evidence rather than a verdict, so this is a caution rather than a severe health failure.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting and response expectations undocumented. This is a transparency gap, although it does not by itself indicate abandonment.

Token permissionscaution

The one workflow lacks top-level token permissions, so its effective GitHub Actions permissions are less explicit than recommended. No top-level write permissions were observed, limiting the severity of this governance gap.

View all 20 health checks

Vulnerabilities

We didn't find any vulnerabilities for this package.

Maintainers

SignalWire Team

Direct Dependencies

Dependency	Last Release	Score
twilio/sdk Version ^7 || ^8	—	—
ramsey/uuid Version ^3.8 || ^4.0	—	—
monolog/monolog Version ^1.24 || ^2.0 || ^3.0	—	—