Package Health/chubbyphp/chubbyphp-parsing

chubbyphp/chubbyphp-parsing

This release appears healthy and suitable for dependency use: it is actively released, stable, non-deprecated, backed by a matching organization-owned repository, and supported by clear documentation, build tooling, security scanning, and repository tests. The main concerns are that recent commit activity is entirely concentrated in one contributor and the repository lacks a security policy and explicit top-level workflow permissions; these are meaningful hygiene and continuity risks, but they do not outweigh the strong maintenance and transparency evidence.

Latest 3.0.2

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

100

Supply Chain

Health Score Breakdown

Repo bus factor

All 38 recent commits were made by one contributor, giving the project a highly concentrated bus factor and creating a genuine continuity risk if that contributor becomes unavailable. Organization backing partially mitigates handoff risk but does not remove the concentration concern.

Security policy

No repository security policy was found, reducing transparency around vulnerability reporting and response procedures. This is a hygiene gap, though security scanning is present.

Token permissions

The CI workflow does not declare top-level token permissions. Although no top-level write permissions were observed, the absence of an explicit restrictive declaration leaves workflow authorization less clear than best practice.