julien-boudry/condorcet

Clear documentation, tests, licensing, and a long release history support dependable adoption. Maintenance is currently concentrated in one contributor, while workflow actions are all unpinned; the low-confidence cache warning is an additional hygiene concern.

Latest v5.0.9

Packagist

68%

Total Score

Maintainer Stability

Dependencies

100

Maturity

100

Supply Chain

Health Score Breakdown

Project backing

The registry namespace and repository are owned by the same individual, and the owner type is User; this supports ownership continuity but provides no organizational maintenance backup.

Repo bus factor

One contributor made all 3 commits in the last 3 months, leaving maintenance dependent on a single active contributor; the repository is user-owned, so there is no organizational handoff evidence to offset this.

Repo commit activity

Only 3 commits were recorded in the last 3 months, indicating relatively sparse recent development despite the recent release history.

Security policy

The repository has no security policy, which is a transparency gap for reporting and handling vulnerabilities.

Workflow audit

All 5 workflows were analyzed with no untrusted checkouts or script injection, and none grants top-level write access. However, all 15 action references are unpinned, and the auditor reported a low-confidence high-severity cache-poisoning pattern; this warrants workflow hygiene caution rather than a severe verdict on its own.