Package Health/cerpus/questionbank-client

cerpus/questionbank-client

The release is licensed and includes tests, a changelog, and release notes. Its workflow uses four unpinned actions, while security scanning and a security policy are absent.

Latest v2.4.0

Packagist

61%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has 34 releases over about 8 years, but its latest release was in December 2024 and there were no releases in the following 12 months, which lowers confidence in active maintenance.

Repo commit activity

The repository recorded no commits and no active maintainers in the last 3 months. The repository was pushed in February 2025, so this indicates a recent maintenance pause rather than confirmed abandonment.

Repo tooling

Composer is used for the build, but no security scanning tools are configured. This is a modest transparency and maintenance gap, not evidence that the package is unsafe.

Security policy

The repository has no security policy. For a service client that handles authentication configuration, this leaves vulnerability-reporting expectations unclear.

Workflow audit

All four analyzed action references are unpinned, reducing build reproducibility. The audit also reported a low-confidence cache-poisoning pattern; because confidence is low and no untrusted trigger or checkout was found, it is a hygiene concern rather than a severe risk.