Package Health/bartlett/sarif-php-converters

bartlett/sarif-php-converters

This release appears usable and generally well maintained from a packaging and transparency perspective: it is licensed under MIT, has extensive documentation, tests, a changelog, a substantial file tree, stable releases, and no deprecation or archive status. The main concern is maintenance continuity: although version 1.7.0 was released recently and the repository was pushed recently, repo_commit_activity reports zero commits and zero active maintainers over the last three months. The project is also backed by a single user account, lacks a security policy and security-scanning tooling, and uses an install-time post-autoload-dump script, so dependency adoption is reasonable but warrants monitoring and review of release provenance.

Latest 1.7.0

Packagist

72%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Lifecycle scripts

The package runs a post-autoload-dump install lifecycle script. This is an execution-time consideration for consumers, though the signal does not establish that the script is unsafe.

Maintainers

Only one account has registry publish access. That is a resilience concern for package publishing, although registry access does not measure actual project activity and the repository shows a corresponding individual owner.

Project backing

The repository is owned by an individual user rather than an organization, so there is no organizational backing to compensate for the thin maintainer and contributor base.

Repo commit activity

The repository records zero commits and zero active maintainers over the last three months. This conflicts with the recent release and push timestamps and is the clearest indication that ongoing development activity may be limited.

Repo issue activity

There are no open issues or pull requests and no issue or pull-request activity in the last month. This is neutral in a small project because the absence of backlog may reflect stability, but it provides little evidence of active community maintenance.