bear8421/gravatar

The package is small and has limited security and workflow safeguards, while its organization-backed repository, tests, licensing, and release notes provide useful structure. Pin a newer release if maintenance resumes; otherwise expect to maintain this dependency yourself.

Latest v1.0.7

Packagist

58%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has 8 releases since September 2021, but none in the last 12 months and its latest release was nearly two years ago. This makes ongoing maintenance uncertain despite a historically regular median interval.

Repo commit activity

The repository recorded 0 commits and 0 active maintainers in the last 3 months, consistent with the long release gap. No other provided activity signal shows recent development to offset that concern.

Repo tooling

Composer build tooling is present, but no security-scanning tools were detected. This is a maintenance and transparency gap rather than evidence that the package is unsafe.

Security policy

The linked repository has no security policy, leaving vulnerability-reporting and response expectations undocumented. The package's small scope limits the impact, but no provided signal compensates for this gap.

Workflow audit

The single workflow was fully analyzed with no audit findings or untrusted execution paths, but all 3 action references are unpinned. That leaves routine build inputs less reproducible than they could be.