josegonzalez/dotenv

The library is licensed, documented, and backed by repository tests. Its workflow uses seven unpinned actions, and the project has no security policy; the small dependency set and read-only job permissions provide some balance.

Latest 4.0.0

Packagist

68%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has 27 releases over more than 12 years, but none in the last 12 months and its latest registry release was in May 2023, indicating slowed maintenance.

Repo commit activity

There were no commits and no active maintainers in the three months measured, which is a concrete sign of currently inactive development despite the later repository push timestamp.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected, leaving a modest transparency and maintenance gap.

Security policy

The repository has no security policy, so users have no documented process for reporting vulnerabilities or understanding security response expectations.

Workflow audit

The single workflow was fully analyzed and uses read-only job permissions with no dangerous triggers or audit findings, but all seven action references are unpinned, weakening build reproducibility and update integrity.