Package Health/chubbyphp/chubbyphp-framework

chubbyphp/chubbyphp-framework

This is a mature, actively released PHP framework with a stable 6.1.2 release, 69 releases over more than seven years, seven releases in the last 12 months, an unarchived matching repository, organization backing, documentation, repository tests, and build/security tooling. The main concern is concentrated maintenance: all five commits in the last three months came from one contributor, while the registry also lists only one publisher, although organizational ownership partly reduces the bus-factor risk. The repository lacks a security policy and does not declare top-level workflow token permissions, which are meaningful transparency and CI-hygiene gaps but not severe enough to outweigh the strong release and repository evidence.

Latest 6.1.2

Packagist

84%

Total Score

Maintainer Stability

Dependencies

100

Maturity

100

Supply Chain

Health Score Breakdown

Repo bus factor

One contributor made 100% of the five recent commits, creating a genuine concentration risk; organization ownership provides some ability to hand maintenance off but does not eliminate the observed dependency on one active contributor.

Repo commit activity

Five commits were made in the last three months by one active maintainer, demonstrating recent activity but indicating limited maintenance capacity.

Security policy

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented; this is a transparency gap for a framework dependency.

Token permissions

The one workflow lacks top-level token permissions, so least-privilege intent is not explicit. No top-level write permissions were observed, limiting the severity of this CI-hygiene gap.

Vulnerabilities

We didn't find any vulnerabilities for this package.

Package versions

Maintainers

Dominik Zogg

Direct Dependencies

Dependency	Last Release	Score
psr/log Version ^2.0\|^3.0.2	—	—
psr/container Version ^1.1.2\|^2.0.2	—	—
psr/http-factory Version ^1.1	—	—
psr/http-message Version ^1.1\|^2.0	—	—
psr/http-server-handler Version ^1.0.2	—	—