islandora/chullo

The package is well documented, tested, licensed, and backed by an organization. Maintenance has gone quiet since the latest release, and the workflows use unpinned actions with inherited secrets.

Latest 2.0.3

Packagist

65%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has existed since 2015 with 19 releases, but it has had no releases in the last 12 months, which lowers confidence in current maintenance.

Repo commit activity

There were no commits and no active maintainers in the prior three months, reinforcing the concern raised by the absence of releases in the last year.

Repo issue activity

There are no open issues or pull requests, but there was also no issue or pull-request activity in the last month; this provides little evidence of ongoing maintenance.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected, leaving a modest repository hygiene gap.

Workflow audit

All three workflows were analyzed with no untrusted checkout or script-injection findings, but all 11 action references are unpinned and a high-confidence medium-severity secrets-inherit finding affects the stale workflow.