Package Health/cweagans/composer-configurable-plugin

cweagans/composer-configurable-plugin

The package has a clear license, tests, documentation, and a source repository that matches its name. Its small runtime dependency footprint, security policy, and non-deprecated status are reassuring, but workflow references are not pinned and should be treated as a maintenance weakness.

Latest 2.0.0

Packagist

62%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has only 3 releases since May 2017, with no releases in the last 12 months and a median interval of about 2.9 years. This is a meaningful sign of slow maintenance, though the project may be intentionally stable.

Repo commit activity

There were 0 commits and 0 active maintainers in the last 3 months. Together with the lack of releases in the last year, this points to limited current maintenance capacity.

Workflow audit

All 8 analyzed action references are unpinned, which weakens workflow reproducibility. The only cache-poisoning finding has low confidence, and there are no untrusted checkouts or script-injection findings, so this is a hygiene concern rather than a severe risk.