Package Health/az-digital/arizona-bootstrap

az-digital/arizona-bootstrap

This release appears healthy and suitable to depend on: it has a mature release history dating from 2020, 49 releases with 18 in the last 12 months, a stable non-prerelease version, no registry deprecation, recent repository activity, organization backing, and limited dependency and workflow risk. The main concerns are that all recent commits come from one bot, the repository does not explicitly match or mention the package name, and the release workflow lacks declared top-level token permissions; these reduce transparency and resilience but are partly offset by the organization-owned repository, active releases, Dependabot, and the package's clearly documented role as a distribution artifact for compiled assets. The absent tests and changelog are not material for this asset-only package, though the missing security policy remains a modest hygiene gap.

Latest v5.2.1

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo bus factor

One contributor, az-digital-bot, made all six commits in the last three months, giving a 100% top-contributor share. Organization backing mitigates handoff risk, but no second active contributor is evidenced in this signal.

Repo commit activity

The repository recorded six commits in the last three months, showing recent activity, but all were produced by only one active maintainer. Activity is present rather than collapsed, though its resilience is limited.

Repo issue activity

There are no open issues and six open pull requests, but no issues or pull requests were newly created or merged during the last month. The open pull requests show some activity, while the lack of recent closures is a modest process concern.

Repo package mention

The repository name does not match the package name and its README does not mention the package. Because this can make package-to-source provenance less transparent, it is a caution, although the repository URL and README identify it as the Packagist distribution repository for Arizona Bootstrap.

Security policy

No security policy is present in the repository. This is a transparency and vulnerability-reporting gap, though it does not by itself indicate abandonment for a small asset distribution package.