hugofara/lwt

This is a healthy, actively maintained release with a strong recent release cadence, stable versioning, an unarchived repository, substantial tests and documentation, and clear package-to-repository linkage. The main concerns are heavy dependence on one contributor, the absence of a declared repository security policy, and incomplete GitHub Actions permission declarations; these warrant operational review but do not outweigh the evidence of active development and mature project scaffolding.

Latest 3.7.0

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Project backing

The repository is owned by the individual user HugoFara rather than an organization. This is compatible with the observed active development, but it provides less organizational maintenance redundancy and reinforces the bus-factor concern.

Repo bus factor

Although two contributors were active, one contributor made 147 of 148 recent commits, or about 99.3%. Because the repository owner is an individual rather than an organization, this concentration is a genuine maintenance-continuity caution.

Repo tooling

Composer is used as a build tool, but no security-scanning tooling was detected. The absence of scanning is a hygiene gap, though it is partly mitigated by the repository's active maintenance and separate workflow analysis.

Security policy

The repository has no SECURITY.md or other declared security policy. This reduces vulnerability-reporting transparency, though it is a governance gap rather than evidence of abandonment.

Token permissions

Seven of eight workflows lack top-level token permissions, and one workflow declares top-level write access; no workflows declare read-only permissions. This leaves GitHub Actions privilege boundaries less explicit than desirable and merits review.