karmabunny/rdb

This is a generally healthy and actively maintained release: it has over five years of history, 66 releases including 15 in the last 12 months, a stable non-prerelease version, a non-deprecated registry status, documented tests and changelog, a complete-looking source tree, and recent repository activity. The main concern is concentration risk: all 12 commits in the last three months came from one contributor, despite the repository being organization-owned. Missing repository security policy and undeclared workflow token permissions are transparency and hardening gaps, but the workflow analysis found no dangerous patterns, and the package has no install-time lifecycle scripts. It appears reasonable to depend on, with normal due diligence around maintainer continuity and dependency updates.

Latest v3.35.26

Packagist

78%

Total Score

Maintainer Stability

Dependencies

Maturity

Supply Chain

Health Score Breakdown

Dependency profile

Five runtime dependencies are a moderate integration surface for a Redis abstraction, including multiple client adapters and serialization support; this is a manageable caution rather than an excessive dependency burden.

Repo bus factor

One contributor made 100% of the 12 recent commits, creating a genuine continuity risk. Organization ownership provides some potential handoff capacity, but no second active contributor is shown by this signal.

Repo commit activity

The repository recorded 12 commits in the last three months, showing recent maintenance, but all activity came from one active maintainer.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected, leaving a security-maintenance gap.

Security policy

The repository has no security policy, which reduces disclosure transparency and documented response expectations for vulnerabilities.