grumpycrouton/grumpypdo

The MIT license, minimal dependency surface, release notes, and matching repository improve transparency. Missing tests, security scanning, and a security policy reduce confidence, although the repository is not archived and installs without lifecycle scripts.

Latest 1.7.1

Packagist

58%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Package scaffolding

The package includes a README and release notes for version 1.7.1, which support consumer understanding and release transparency. Tests and a changelog are absent, but those are normally repository rather than published-artifact contents; the absent tests still leave less evidence of ongoing quality assurance.

Release history

The latest release was in October 2022, with no releases in nearly four years. That long gap is a meaningful maintenance concern for a dependency, despite the package having a stable release history before then.

Repo commit activity

The repository recorded no commits and no active maintainers in the last three months, consistent with the nearly four-year release gap. This indicates currently low maintenance capacity.

Repo tooling

Composer is used for the build, but no security scanning tool is configured. That is a modest transparency and maintenance gap, not evidence that the release is unsafe.

Security policy

The linked repository has no security policy, leaving no documented process for reporting and handling vulnerabilities. This modestly reduces maintenance transparency.