armin/editorconfig-cli

It has a clear MIT license, a substantial README, repository tests, and a recent stable release. The single active contributor, three months without commits, missing security policy, and workflow pinning gaps add maintenance and release-hygiene risk.

Latest 2.2.1

Packagist

65%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Project backing

The repository is owned by an individual rather than an organization, so the project has a narrower apparent backing base. The recent release and repository tests provide some compensation.

Repo commit activity

The repository recorded no commits and no active maintainers in the last three months. The recent release partly compensates, but the current lack of development activity raises abandonment risk.

Repo tooling

Composer build tooling is present, but no security-scanning tool was detected. That is a modest transparency and maintenance gap rather than evidence of an unsafe release.

Security policy

The repository has no security policy, leaving vulnerability-reporting expectations unclear for a maintained CLI tool.

Workflow audit

Both workflows were analyzed completely and have no untrusted triggers or sinks, but all 11 action references are unpinned and one high-confidence archived-action finding was reported. The low-confidence cache findings are hygiene concerns only.

Vulnerabilities

We didn't find any vulnerabilities for this package.

Package versions

Maintainers

Armin Vieweg

Direct Dependencies

Dependency	Last Release	Score
symfony/mime Version ^5 \|\| ^6 \|\| ^7 \|\| ^8	—	—
symfony/finder Version ^5 \|\| ^6 \|\| ^7 \|\| ^8	—	—
symfony/console Version ^5 \|\| ^6 \|\| ^7 \|\| ^8	—	—
idiosyncratic/editorconfig Version ^0.1.1	—	—