castle/castle-php

castle/castle-php 4.1.1 appears generally healthy and suitable for dependency use: it has a long release history, a stable non-prerelease version, recent releases, an active non-archived organization-owned repository, complete README/tests/changelog coverage, a matching source repository, and no install-time lifecycle scripts or registry deprecation. The main concerns are that recent commit activity is concentrated in one contributor, repository security scanning is absent, the workflows do not declare top-level token permissions, and the repository has low popularity; these are meaningful hygiene and continuity concerns but do not outweigh the evidence of current releases, merged pull requests, and project backing.

Latest 4.1.1

Packagist

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo bus factor

All recent commits come from one contributor, giving a 100% top-contributor share and creating continuity risk. Organization ownership provides some ability to hand maintenance off, but no second active contributor is shown in this period.

Repo commit activity

Only one commit was made in the last three months by one active maintainer, which suggests a thin recent maintenance cadence. This is partly offset by three merged pull requests in the last month and the recent release, but the direct commit activity remains limited.

Repo popularity

The repository has only 8 stars and 7 forks, indicating limited adoption signals. Popularity is supporting evidence rather than a verdict, so this is a modest concern rather than a severe risk.

Repo tooling

Composer build tooling is present, but no security scanning tools are configured. The missing scanning is a repository hygiene gap, though it is not evidence that the package is malicious.

Security policy

The repository has no security policy, reducing transparency about vulnerability reporting and response expectations. This is a hygiene gap, not a standalone indication that the package is unsafe.