exbil/mailcow-php-api

The license text conflicts with the declared GPL-3.0-or-later license, and both workflow actions are unpinned. A release-specific changelog, clear README, read-only workflow permissions, Dependabot, and a security policy provide useful safeguards.

Latest 0.15.0

Packagist

61%

Total Score

Maintainer Stability

Maturity

Supply Chain

100

Health Score Breakdown

License

The artifact includes a license, but it is detected as AGPL-3.0 while the manifest declares GPL-3.0-or-later; that mismatch reduces licensing transparency.

Release history

Only three releases have been published since October 2023, with one release in the last 12 months and a median interval of about 13 months, indicating a slow maintenance cadence.

Repo commit activity

There were zero commits and zero active maintainers in the last three months, which is a meaningful sign of currently stalled development.

Version stability

Version 0.15.0 is not a stable major release, but it is not a prerelease and recent releases contain no prerelease versions, which limits the concern.

Workflow audit

The single workflow was fully analyzed with no audit findings, no untrusted checkouts, no script injection, and read-only permissions. However, both action references are unpinned, leaving a supply-chain hygiene gap.