jerome/matrix

Documentation, tests, licensing, and security reporting are all in place. The small maintainer base leaves less backup if development stops.

Latest 4.0.0-beta.1

Packagist

66%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo bus factor

One contributor made all commits in the last three months, leaving no demonstrated backup maintainer in the recent activity window. The repository owner is an individual rather than an organization, so there is no shown organizational handoff capacity to offset this.

Repo commit activity

Only one commit was recorded in the last three months, despite a release on 2026-07-30. The recent release is positive, but the limited observed development activity warrants caution.

Version stability

The assessed release is 4.0.0-beta.1, so it carries pre-release compatibility risk even though pre-releases represent only about 9% of recent releases.

Workflow audit

All four workflows were analyzed, but all 12 action references are unpinned, which weakens build reproducibility. The audit also reports a high-confidence bot-conditions issue in the Dependabot auto-merge workflow and a top-level write permission there; the pull_request_target trigger has no untrusted checkout or script-injection sink, so this is a hygiene concern rather than a severe standalone risk.