calvient/arbol

calvient/arbol 1.0.4 appears healthy and reasonable to depend on: it has a substantial release history, a current stable release, recent repository activity, clear licensing, comprehensive documentation and tests, a matching source repository, and no deprecation or archival indicators. The organization-owned repository provides useful maintenance backing, although repository popularity is currently negligible, commit activity is concentrated in one contributor, and the project lacks a security policy and explicit GitHub Actions token permissions. These are transparency and resilience cautions rather than evidence of abandonment, especially given the recent releases, merged pull requests, active second contributor, and current repository push.

Latest 1.0.4

Packagist

84%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo bus factor

The top contributor made 8 of 9 recent commits, showing concentrated maintenance and some handoff risk. The second contributor remains active, and organization ownership provides additional backing, so this is not a severe single-maintainer failure.

Repo popularity

The repository has zero stars, forks, and watchers, so there is little external adoption evidence or visible community support; this lowers confidence in long-term ecosystem resilience but is not decisive for a small package.

Repo tooling

Composer build tooling is present, but no security scanning tools are configured, leaving a gap in automated supply-chain and dependency assurance.

Security policy

The repository has no SECURITY.md or other declared security policy, reducing transparency about vulnerability reporting and response expectations.

Token permissions

The only workflow lacks top-level token permissions. No write permissions were observed, but explicitly declaring least-privilege permissions would provide stronger CI hardening and transparency.