gonimar/yii2-robokassa

The package is licensed, tested, and backed by a matching organization repository that is not archived. Its small dependency surface and clean workflow audit help, but the long release gap and missing security policy leave adoption risky.

Latest 1.3.1

Packagist

38%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Registry deprecation

Packagist marks the package as abandoned, even though the listed replacement is the same package name. This is a direct warning against starting a new dependency on this release.

Release history

The latest registry release was on July 2, 2019, with no releases in the last 12 months. That is over seven years without a published update, which materially raises abandonment risk.

Repo commit activity

The repository recorded no commits and no active maintainers in the last three months. A push in February 2025 shows it is not fully abandoned, but current development activity remains weak.

Security policy

The repository has no SECURITY.md or equivalent security policy. This weakens vulnerability-reporting transparency, though it is not evidence of a security defect by itself.

Workflow audit

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all five action references are unpinned, leaving avoidable build-reproducibility risk.