formal/migrations

Clear licensing, documentation, and release notes make integration easier. The small release history and workflow hygiene leave less evidence of ongoing maintenance, so pinning version 2.0.0 is prudent.

Latest 2.0.0

Packagist

62%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has only three releases over about 715 days, with one release in the last 12 months and a median interval of about 273 days. This indicates a small and infrequent maintenance cadence.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the past three months. Although a recent release exists, this provides limited evidence of current development capacity.

Repo tooling

The repository uses Make and Composer build tooling, but no security-scanning tools were detected. The missing automated security coverage is a maintenance hygiene concern, not evidence that the package is unsafe.

Security policy

The repository has no security policy. That reduces transparency about vulnerability reporting and response expectations.

Workflow audit

All three workflows were analyzed, but all 11 action references are unpinned; two high-confidence medium-severity secrets-inherit findings also pass credentials to reusable workflows, and one workflow has top-level write permissions. These are meaningful supply-chain hygiene weaknesses, although no untrusted checkout or script-injection path was found.