durimjusaj/gaufrette

The package is clearly licensed, documented, and supported by repository tests, tooling, and a matching source project. Its registry release history is stale, while workflow references and a high-confidence unpinned container image weaken publishing hygiene.

Latest 1.1

Packagist

60%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Project backing

The registry namespace and repository are owned by the same individual account, with no organization backing shown. This does not prove abandonment, but it indicates a relatively thin ownership base.

Release history

Only two releases are recorded, both on the same date about 1 year and 9 months ago, with no releases in the last 12 months. That makes current maintenance and compatibility progress uncertain.

Repo commit activity

There were zero commits and zero active maintainers in the last three months. Combined with no registry releases in the last year, this is evidence of slowed maintenance.

Security policy

No repository security policy was found. This is a transparency gap for reporting vulnerabilities, though the available tooling and project documentation provide some compensating project hygiene.

Workflow audit

All 11 action references are unpinned, and the audit found a high-confidence unpinned container image in bc.yml. No untrusted checkout or script injection was found, but the release workflow remains exposed to changing upstream content.