golovanov/weft

Documentation is strong, and the repository includes tests and release notes. The single-contributor project, pre-1.0 version, absent security scanning, and unpinned CI actions leave more maintenance and build-integrity risk than a mature dependency.

Latest v0.1.3

Packagist

68%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Project backing

The repository owner is an individual user rather than an organization, so the single-maintainer and bus-factor concerns are not offset by visible organizational backing.

Repo bus factor

All seven recent commits came from one contributor, so maintenance depends entirely on a single person and has a fragile handoff path.

Repo tooling

Composer build tooling is present, but no security-scanning tool was detected; this is a meaningful gap for an engine that includes web and form-security components.

Security policy

The repository has no security policy, leaving no documented channel or process for reporting and handling vulnerabilities in this security-relevant web package.

Version stability

v0.1.3 is not a stable major release, so its public API and behavior may still change substantially despite the absence of prerelease labeling.