chapdel/credits

The MIT license, README, changelog, and modest dependency set make the package straightforward to inspect and integrate. Its workflows still have unpinned actions and a high-confidence bot-condition warning, so automated maintenance deserves caution.

Latest 1.1

Packagist

56%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has only two releases, both within about one week, and none in the last 12 months; the latest release is about 18 months old. This is a meaningful maintenance concern for a young package.

Repo commit activity

The repository recorded zero commits and zero active maintainers over the last three months, consistent with the long gap since its latest release. No provided activity signal compensates for this inactivity.

Security policy

The repository has no security policy, leaving vulnerability-reporting expectations unclear. This is a transparency gap, although Dependabot scanning provides some compensating security tooling.

Workflow audit

All 6 analyzed action references are unpinned, and the audit found a high-confidence bot-conditions issue in the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, limiting this to workflow hygiene rather than a severe risk.