hotrush/php-vcr

The project lacks security scanning and pins none of its seven GitHub Actions references. It does provide a clear README, tests in the repository, release notes, and matching MIT licensing, but maintenance has stopped for about 3 years 8 months.

Latest 1.8.0

Packagist

52%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

Only two releases exist, with no release in about 3 years 8 months and none in the last 12 months. This is meaningful abandonment risk despite the stable 1.8.0 version.

Repo commit activity

There were zero commits and zero active maintainers in the last three months, consistent with the long release gap. This materially lowers confidence in ongoing maintenance.

Project backing

The registry namespace and repository owner match, but ownership is an individual account rather than an organization. This offers limited visible backing for recovery if maintenance stops.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected. That is a transparency and maintenance gap for a package that handles recorded HTTP data.

Security policy

The repository has no security policy. This weakens the project's documented response path, although it is not by itself evidence that the release is unsafe.

Vulnerabilities

We didn't find any vulnerabilities for this package.

Package versions

Maintainers

Adrian Philipp

Direct Dependencies

Dependency	Last Release	Score
symfony/yaml Version ^3.0\|^4.0\|^5.0\|^6.0	—	—
beberlei/assert Version ^3.2.5	—	—
defuse/php-encryption Version ^2.3	—	—
symfony/event-dispatcher Version ^5.0\|^6.0	—	—