hiqdev/hoa-protocol

The package has tests, a changelog, a clear README, and organization backing. However, it has had no registry release since October 2022 and recorded no commits or active maintainers in the last three months; workflow dependencies are also unpinned.

Latest 1.0.2

Packagist

58%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The latest release was in October 2022, with no releases in the last 12 months despite a package age of over four years. This materially raises maintenance and abandonment concerns.

Repo commit activity

No commits and no active maintainers were recorded during the last three months. The non-archived status and organization ownership provide some context, but do not offset the weak observed maintenance activity.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected. This is a modest transparency and maintenance gap rather than a standalone severe risk.

Security policy

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.

Workflow audit

The single workflow was fully analyzed with no dangerous triggers or audit findings, but all three referenced actions are unpinned and the workflow lacks a top-level permissions block. The absence of write permissions keeps this as a hygiene concern.