keboola/csv

There is no recent repository activity or release in the last two years, which raises maintenance risk for future fixes. Tests, release notes, licensing, and organization backing provide useful evidence that this is a mature package.

Latest 4.1.0

Packagist

64%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has 34 releases and a median interval of about 34 days, but it has had no release in the last two years. That long release gap lowers confidence in ongoing maintenance.

Repo commit activity

There were no commits and no active maintainers in the last three months, consistent with the broader absence of activity since 2024. This is the clearest ongoing-maintenance concern.

Repo tooling

Composer is used for builds, but no security scanning tools were detected. For a small library this is a modest transparency and maintenance gap rather than a standalone severe risk.

Security policy

The repository has no security policy. That makes vulnerability-reporting expectations less clear, though it is partly offset by the package's small scope and mature test coverage.

Workflow audit

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, its only action reference is unpinned, and it has no top-level permissions block, so workflow supply-chain hygiene is incomplete.