alto/font

Documentation, release notes, and a security policy give consumers useful project context. The repository is active and organization-backed, but its single-contributor history and unpinned workflow actions merit monitoring.

Latest v0.8.0

Packagist

68%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

100

Health Score Breakdown

Release history

The package is only 41 days old and has two releases, both published within a short interval. This shows initial activity but provides limited evidence of long-term maintenance.

Repo bus factor

One contributor made all 10 commits in the last three months, giving the project a concentrated maintenance base. Organization ownership provides some handoff capacity, but no second active contributor is shown.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected. The missing scanning is a hygiene gap, not evidence of unsafe code by itself.

Version stability

v0.8.0 is not a prerelease, but the package has not reached a stable major version. That signals some API-change risk rather than abandonment.

Workflow audit

The only workflow was fully analyzed, uses read-only permissions, and has no untrusted checkout or injection findings. However, all six action references are unpinned, leaving workflow dependencies exposed to upstream changes.