horde/pear

The package includes tests, documentation, and a matching LGPL-2.1 license. Organization backing and recent repository activity provide continuity, but the missing security policy and mostly unpinned workflow actions leave transparency and build-integrity gaps.

Latest v2.0.0alpha3

Packagist

67%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Repo bus factor

All 3 recent commits came from one contributor, giving the repository a concentrated short-term bus factor. Organization ownership provides some handoff capacity, but no second active contributor is shown.

Repo tooling

Composer is used for builds, but no security scanning tool was detected. The build tooling is appropriate, while the missing scanning capability is a modest repository hygiene gap.

Security policy

The repository has no security policy. For a library that handles remote PEAR interfaces and package metadata, this reduces clarity about vulnerability reporting and response.

Version stability

The assessed release is v2.0.0alpha3, while the reported latest version is stable v1.0.0. Depending on this alpha means accepting greater compatibility risk than a stable release.

Workflow audit

Both workflows were analyzed without audit findings or dangerous untrusted triggers, and one scopes permissions at job level. However, 6 of 7 action references are unpinned, leaving avoidable supply-chain reproducibility risk.