Package Health/codelieutenant/scylla-driver

codelieutenant/scylla-driver

This release appears healthy and suitable for consideration as a dependency: it has a long release history, seven releases in the last 12 months, a stable non-prerelease version, no registry deprecation, an active non-archived repository, substantial tests and documentation, and a clear Apache-2.0 license. Recent repository activity is strong, with 64 commits, 14 merged pull requests, and six closed issues in the measured periods. The main concerns are concentrated recent contribution activity, with one contributor responsible for about 86% of commits, no automated security-scanning tooling, and two workflows declaring top-level write permissions; these warrant review but do not outweigh the evidence of active maintenance and project backing.

Latest v1.5.1

Packagist

84%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Dangerous workflows

One workflow uses pull_request_target, which requires careful handling of untrusted pull requests, although no untrusted checkout or script-injection patterns were detected. This warrants workflow review but is not by itself a severe health risk.

Repo bus factor

Recent work is concentrated: the top contributor made about 86% of commits, with only two contributors active in three months. The organization-owned repository and a second active contributor partly mitigate this, but contributor concentration remains a real continuity concern.

Repo tooling

The project uses CMake and Composer, demonstrating established build tooling, but no security-scanning tools were detected. The missing scanning is a hygiene gap rather than evidence of abandonment.

Token permissions

All workflows declare permissions, and two use read-only permissions; however, backport.yml and release.yml declare top-level write permissions. The explicit permissions are better than an undeclared posture, but broad write access increases CI supply-chain exposure.