dco-ai/php-jina

The README, Apache-2.0 license, and exact-version release notes improve transparency. Maintenance has effectively stopped for about three years and five months, while the tiny project has no security policy and uses three unpinned workflow actions with broad write permissions.

Latest v1.1.6

Packagist

45%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Release history

The latest release was published on April 18, 2023, with no releases in the last 12 months, indicating a long period without maintenance updates. The package has 10 releases and is mature enough to be stable, but the prolonged inactivity is a substantial concern.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the release gap and indicating little current maintenance capacity.

Repo popularity

The repository has only 2 stars, 1 fork, and 0 watchers, so there is limited visible community support to offset the single-maintainer and inactivity concerns.

Security policy

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented. This is a maintenance and transparency gap, though it is not evidence of malicious behavior.

Workflow audit

The single workflow has no untrusted-code trigger or audit findings, but all 3 referenced actions are unpinned and the workflow grants top-level write permissions. That weakens build reproducibility and least-privilege hygiene without establishing a severe risk on its own.