Package Health/carbonphp/carbon-doctrine-types

carbonphp/carbon-doctrine-types

This is a generally healthy, well-scoped package with a stable release, clear MIT licensing, a matching organization-owned repository, repository tests, and no install-time lifecycle scripts or dangerous workflow patterns. The main concerns are that repository commit activity shows no commits or active maintainers in the last 3 months, issue and pull-request activity is also quiet, and the repository lacks an explicit security policy and top-level workflow permissions; these are meaningful maintenance and transparency gaps, though they are partly offset by a release published on the assessment date, recent repository push activity, a non-archived repository, and a focused dependency profile.

Latest 3.2.1

Packagist

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo commit activity

The repository recorded 0 commits and 0 active maintainers during the last 3 months, which is the strongest health concern because it indicates a recent lapse in observable development activity. The recent release and repository push provide some compensation but do not establish sustained ongoing maintenance.

Repo issue activity

There is only 1 open issue and 1 open pull request, with no new or closed issues or merged pull requests in the last month. This quiet activity is a modest maintenance concern, though the small package scope may naturally generate little issue traffic.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected. The missing security automation is a transparency and hygiene gap, not by itself evidence that the package is unsafe.

Security policy

The repository has no security policy, leaving vulnerability-reporting procedures undocumented. This lowers transparency, although it does not by itself indicate poor code health.

Token permissions

Neither of the two workflows declares top-level token permissions, so least-privilege intent is not explicit. No workflow declares top-level write access, which limits the severity of this hygiene gap.