danielspk/tornado

Risky to adopt: the package has had no release for over 11 years and its repository has seen no commits for over 10 years. It has solid basic packaging and licensing, but the long abandonment gap outweighs those strengths.

Latest v2.0.0

Packagist

43%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The latest release was published in June 2015, with no releases in the last 12 months. That long period without updates is strong evidence of abandonment for a framework dependency.

Repo commit activity

There were zero commits and zero active maintainers in the last 3 months. Combined with the old last push, this indicates no current maintenance capacity.

Repo tooling

Composer is used for builds, but no security scanning tooling is present. This is a modest transparency gap, though it is secondary to the much older maintenance history.

Repository archived

The repository is not marked archived, which avoids the strongest abandonment signal, but it was last pushed in June 2016 and therefore has still been inactive for over 10 years.

Security policy

The repository has no published security policy. For a framework intended to handle web requests, that weakens vulnerability-reporting transparency.