lion/files

lion/files v9.1.5 appears generally healthy and usable as a dependency: it has a stable major release, a substantial release history with 7 releases in the last 12 months, an unarchived repository, MIT licensing, tests, changelog documentation, Composer tooling, and organization backing. The main concerns are limited recent repository activity concentrated entirely in one contributor, the absence of a security policy, and a workflow without top-level token permissions; these lower the score but do not indicate abandonment, especially given the recent release and merged pull request activity.

Latest v9.1.5

Packagist

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo bus factor

All recent commits came from one contributor, creating concentration risk. Organization ownership provides some handoff capacity, but no second active contributor is shown in this signal.

Repo commit activity

There was 1 commit in the last 3 months from 1 active maintainer, showing recent but very light maintenance activity; the release history partly compensates for the low short-term commit volume.

Repo popularity

The repository has only 1 star, 0 forks, and 1 watcher. This is weak supporting evidence, but popularity is not decisive and the package has other signs of maintenance.

Security policy

No repository security policy was found. This is a genuine transparency gap for reporting vulnerabilities, although the repository does use Dependabot scanning.

Token permissions

The workflow lacks top-level permissions and instead declares permissions only at job level; no top-level write access was found, but explicit read-only defaults would provide clearer least-privilege assurance.