hirethunk/verbs-history

Clear licensing, repository tests, release notes, and organization backing improve transparency. The small dependency footprint and security scanning help, but they do not offset the long maintenance gap and workflow weaknesses.

Latest v0.6.0

Packagist

45%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has had no release in over 20 months and none in the last 12 months, with only three releases overall. That is a substantial abandonment concern, despite the previously regular roughly 85-day release interval.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last three months, reinforcing the prolonged release gap rather than showing ongoing maintenance between releases.

Workflow audit

All 13 analyzed action references are unpinned, and three workflows grant top-level write permissions. A high-confidence bot-conditions finding affects the Dependabot auto-merge workflow; the pull request target trigger has no untrusted checkout or script-injection sink, so this is a serious hygiene concern rather than a standalone critical risk.

Lifecycle scripts

The package runs post-autoload-dump, post-install-cmd, and post-update-cmd scripts, increasing install-time behavior and review burden for consumers. No provided signal shows these scripts are unsafe, so this is a modest supply-chain concern.