esi/bench

The small runtime dependency set, MIT licensing, README, tests, release notes, and security policy support straightforward adoption. Recent repository activity is uneven, and every analyzed workflow uses unpinned actions, leaving meaningful maintenance and build-integrity caveats.

Latest v3.2.0

Packagist

68%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

100

Health Score Breakdown

Project backing

The repository is owned by an individual rather than an organization, so the project appears to rely on a small personal maintainer base.

Release history

The package has four releases over about two years, with one release in the last 12 months; this indicates a small but continuing release history rather than abandonment.

Repo commit activity

There were no commits and no active maintainers in the last three months, a meaningful maintenance concern; recent pull-request merges and a recent release provide only partial compensation.

Workflow audit

All three workflows were analyzed with no reported audit findings and no untrusted checkout or script-injection sinks. However, all 17 action references are unpinned, which weakens build reproducibility and makes workflow dependencies more exposed to upstream changes.