horde/idna

Tests, changelog, release notes, and a recent push provide useful project evidence. The missing package README and six unpinned workflow actions reduce transparency and build reproducibility, while organization backing helps offset the single-contributor concentration.

Latest v2.0.0

Packagist

78%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Package scaffolding

The artifact includes tests and a changelog, and this version has GitHub release notes; those provide strong maintenance and change-history evidence. The package lacks a README, which is a minor documentation gap for a library.

Repo bus factor

All 3 recent commits came from one contributor, leaving no demonstrated contributor redundancy. Organization ownership provides some handoff capacity, but the observed activity remains concentrated.

Repo tooling

Composer build tooling is present, but no security scanning tool was detected. That is a meaningful repository hygiene gap, though it does not by itself indicate abandonment.

Security policy

The repository has no security policy, reducing clarity about vulnerability reporting and response. This is a transparency weakness rather than a severe dependency risk on its own.

Workflow audit

Both workflows were analyzed successfully with no untrusted checkouts, script injection, or high-severity findings, and permissions are not broadly writable. However, 6 of 7 action references are unpinned, weakening build reproducibility.