dbeurive/gpg

The focused scope, clear documentation, test suite, and explicit license make the package straightforward to evaluate. Nearly ten years without a release and no recent repository activity make it a poor long-term dependency choice; treat 1.0.1 as frozen.

Latest 1.0.1

Packagist

43%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

Only two releases were published, with the latest nearly ten years ago and none in the last 12 months. This is strong evidence of abandonment risk despite the short initial release interval.

Repo commit activity

There were no commits and no active maintainers in the last three months. Combined with the old last push and release history, this materially increases abandonment risk.

Repo issue activity

There were no new or closed issues or pull requests in the last month. With no recent commits, this supports a picture of an inactive project rather than an actively maintained one.

Repo tooling

The repository uses Composer, but no security scanning tooling was detected. That is a hygiene gap for a package handling cryptographic operations, although it is not evidence of a vulnerability by itself.

Security policy

No security policy was found in the repository. This weakens vulnerability-reporting transparency, particularly for a GPG wrapper, but does not independently make the release unfit.