davereid/drupal-environment

This is a generally healthy, transparent Composer package with a stable 1.2.0 release, a matching public repository, tests, clear documentation, licensing, minimal runtime dependencies, automated build tooling, Dependabot scanning, and no install-time lifecycle scripts or deprecated status. The main concern is maintenance momentum: the repository recorded no commits and no active maintainers in the last 3 months, although a release was published very recently and issue/pull-request activity shows some continued maintenance. The single registry maintainer and absence of a security policy add modest resilience and transparency concerns, while the workflow permissions deserve review because one Dependabot workflow has top-level write access. It appears reasonable to depend on, with normal due diligence and awareness that its contributor base is small.

Latest 1.2.0Packagist

Health Score Breakdown

Project backingcaution

The repository is owned by an individual rather than an organization, so the single registry maintainer reflects a genuinely thin maintainer base rather than organization-backed publishing capacity.

Repo commit activitycaution

There were 0 commits and 0 active maintainers in the last 3 months, which is a meaningful maintenance-momentum concern; the recent release and other repository activity provide only partial compensation.

Security policycaution

No SECURITY policy is present, leaving vulnerability-reporting guidance unclear; this is a modest transparency gap for a package intended as a reusable dependency.

Token permissionscaution

Both workflows declare permissions, but one Dependabot workflow has top-level write access while the other is read-only, creating a limited permissions-hardening concern.

View all 17 health checks

Vulnerabilities

We didn't find any vulnerabilities for this package.

Maintainers

Dave Reid