arcanedev/gravatar

The MIT license, matching source repository, included tests, and organizational backing support a transparent and established package. Its maintenance has effectively stopped, and all three workflow actions are unpinned, so future compatibility and build integrity need attention.

Latest 5.0.1

Packagist

61%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has 24 releases, but none in the last 12 months; its latest release was in December 2020, nearly six years ago. This is strong evidence of stalled maintenance for a dependency that may need ongoing compatibility work.

Repo commit activity

The repository recorded no commits and no active maintainers in the last three months, consistent with the long release gap. There is no provided evidence of current maintenance capacity.

Security policy

The repository has no published security policy. That reduces transparency about vulnerability reporting and response, although it is a process gap rather than evidence of an unsafe release.

Workflow audit

The single workflow was fully analyzed with no high- or medium-severity findings, no untrusted checkouts, and no script injection. However, all three action references are unpinned, leaving the build exposed to unexpected upstream action changes.