innmind/colour

The small runtime dependency set and complete package documentation keep adoption straightforward. Maintenance is active, but recent commits come from one contributor and the workflows use unpinned actions with inherited secrets.

Latest 5.2.0

Packagist

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo bus factor

One contributor made 100% of the four recent commits, creating concentration risk; organization ownership provides some ability to hand maintenance off, so this is a limited concern rather than a severe liability.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected, leaving a modest transparency and maintenance gap.

Security policy

The repository has no security policy, so there is no documented path for reporting vulnerabilities or explaining security response expectations.

Workflow audit

All three workflows were analyzed successfully and have no untrusted checkouts or script injection, but all six action references are unpinned and two high-confidence medium-severity findings involve inherited secrets.