Package Health/curder/commonmark-extensions

curder/commonmark-extensions

Clear documentation, tests, licensing, and a small runtime dependency set support adoption. The single-user project has no security policy, and its workflows use unpinned actions, increasing maintenance and build-hygiene concerns.

Latest v1.0.2

Packagist

51%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Maintainers

One registry maintainer is consistent with the linked repository being user-owned, but it leaves the project dependent on a single publisher.

Release history

The package has had no release in the last 12 months, and all three releases occurred within a short period on its first day. This is a meaningful sign of inactivity for a package nearly two years old.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the lack of recent releases and indicating no observed ongoing maintenance.

Security policy

The repository has no published security policy, leaving no documented process for reporting or handling security issues.

Workflow audit

Both workflows were analyzed successfully with no dangerous triggers, untrusted checkouts, or audit findings, and one scopes permissions at job level. However, all seven action references are unpinned, creating avoidable build reproducibility and dependency-update risk.