innmind/static-analysis

Its small meta-package layout is documented with a README, MIT license, and release notes for this version. The repository shows no commits in the last three months, and its workflow passes secrets to a reusable workflow while leaving its only action unpinned.

Latest 1.3.0

Packagist

65%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has six releases over 621 days and only one release in the last 12 months, indicating a slow cadence; the recent 1.3.0 release provides some evidence of ongoing maintenance.

Repo commit activity

There were zero commits and zero active maintainers in the last three months, which is a maintenance concern; the January release and recent push provide limited compensating evidence.

Repo tooling

The repository uses Composer, but no security-scanning tooling was detected. For a small dependency-alias project this is a modest transparency gap rather than a severe concern.

Security policy

The repository has no security policy, leaving vulnerability-reporting expectations unclear; the package's small scope limits the practical impact.

Workflow audit

The single workflow was fully audited with no untrusted checkout or script injection, but it passes secrets to a reusable workflow and its only action is unpinned. These are medium-risk workflow hygiene concerns without a dangerous trigger or sink.