hyperf/carbon

Recent releases show the project is still shipped, and the organization-backed repository is not archived. However, no commits or active maintainers were recorded in the last three months, and both workflows use unpinned actions; the missing consumer documentation also limits transparency.

Latest v3.2.0

Packagist

65%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Package scaffolding

The artifact has no README, but the repository has tests and this exact version has GitHub release notes linking to the full changelog. Tests and release documentation partly compensate for the missing package README, though consumer-facing guidance remains limited.

Repo commit activity

No commits or active maintainers were recorded in the last three months. The recent release and push provide some compensation, but the lack of ongoing development activity raises maintenance risk.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected. The missing scanning is a hygiene gap, partly offset by the repository's separate security policy.

Workflow audit

Both workflows were fully analyzed with no reported audit findings, and the pull_request_target workflow has no untrusted checkout or script-injection sink. However, all 2 of 2 action uses are unpinned, leaving a supply-chain hygiene gap.