getlate-dev/late-php

Frequent releases and recent commits show active maintenance, with organization backing and a shared contributor base. Workflows leave all six actions unpinned and install a package outside a lockfile. The SDK has extensive documentation, tests, and no install-time scripts.

Latest 0.0.857

Packagist

58%

Total Score

Maintainer Stability

100

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

License

The manifest declares Unlicense while the artifact and repository license file are detected as MIT. A license is present, but the conflicting declarations create uncertainty about the release's applicable terms.

Repo package mention

The repository name does not match the package name, and its README does not mention the package, so the package-to-source relationship is not transparent. The generated SDK documentation identifies Zernio instead, which only partly explains the mismatch.

Security policy

The repository has no security policy. This is a transparency gap for reporting vulnerabilities, though it does not by itself show that maintenance has stopped.

Version stability

Version 0.0.857 is not on a stable major version, so compatibility expectations are limited. It is not a prerelease and recent prerelease share is 0%, which partly offsets that concern.

Workflow audit

Both workflows were analyzed without trigger or script-injection risks, and one scopes permissions at job level. However, all six action references are unpinned and a high-confidence finding reports an ad hoc package installation outside a lockfile, weakening build reproducibility.