baril/bonsai

The repository has no security policy and all 8 workflow actions are unpinned, which weakens maintenance and build transparency. Recent releases, tests, release notes, and a non-archived matching repository provide meaningful support.

Latest v3.5.0

Packagist

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo commit activity

There were no commits and no active maintainers in the last three months. The recent release offsets this somewhat, but the lack of current commit activity is a maintenance caution.

Repo tooling

Composer build tooling is present, but no security-scanning tool was detected. This is a modest transparency gap rather than evidence that the package is unsafe.

Security policy

The repository has no security policy. That leaves vulnerability-reporting and response expectations unclear for a package used in application code.

Workflow audit

All 6 workflows were analyzed successfully with no high- or medium-confidence findings, no untrusted checkouts, and no script injection. However, all 8 analyzed action references are unpinned, which weakens build reproducibility and supply-chain hygiene.

Vulnerabilities

We didn't find any vulnerabilities for this package.

Package versions

Maintainers

No maintainer information available.

Direct Dependencies

Dependency	Last Release	Score
illuminate/console Version ^8.0\|^9.0\|^10.0\|^11.0\|^12.0\|^13.0	—	—
illuminate/support Version ^8.0\|^9.0\|^10.0\|^11.0\|^12.0\|^13.0	—	—
illuminate/database Version ^8.0\|^9.0\|^10.0\|^11.0\|^12.0\|^13.0	—	—