codeigniter4/devkit

Security scanning, a clear license, and release notes provide useful maintenance and consumer context. Workflow actions are all unpinned, leaving avoidable build-integrity exposure despite the repository’s organization backing and security policy.

Latest v1.3.0

Packagist

68%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has 25 releases and a typical historical interval of about 17 days, but it has had no registry release in the last 12 months. That prolonged release pause lowers confidence in ongoing maintenance.

Repo commit activity

There were no commits and no active maintainers in the last three months. Combined with no registry release in the last year, this indicates a current maintenance lull rather than active development.

Repo issue activity

There were no new or closed issues or pull requests in the last month, although two pull requests remain open. This adds modest evidence of low current activity but is not severe by itself.

Workflow audit

All four analyzed workflows completed the audit without reported findings or untrusted checkouts, but all 15 action references are unpinned. That is a meaningful reproducibility and supply-chain hygiene gap, though no dangerous trigger or sink was found.

Vulnerabilities

We didn't find any vulnerabilities for this package.

Package versions

Maintainers

Matthew Gatner

Direct Dependencies

Dependency	Last Release	Score
vimeo/psalm Version ^6.0	—	—
rector/rector Version ^2.0	—	—
fakerphp/faker Version ^1.9	—	—
phpstan/phpstan Version ^2.0	—	—
phpunit/phpunit Version ^10.5 \|\| ^11.5	—	—