innmind/url

Clear licensing, a small dependency set, and release notes make the package easy to evaluate. Maintenance is concentrated in one contributor, while workflow credentials are broadly inherited and all six actions are unpinned.

Latest 5.4.0

Packagist

76%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo bus factor

All 29 recent commits came from one contributor, so maintenance depends heavily on a single person. Organizational ownership provides some handoff capacity, but no second active contributor is evidenced here.

Repo tooling

The project uses Composer for builds, but no security scanning tools were detected. This is a modest transparency and maintenance gap rather than a severe risk.

Security policy

No security policy was found in the repository, leaving vulnerability reporting guidance unspecified.

Workflow audit

All 3 workflows were analyzed with no untrusted checkouts or script-injection findings, but all 6 action references are unpinned and two high-confidence medium-severity findings show secrets inherited by reusable workflows. These are meaningful workflow hygiene and credential-scope concerns.