Package Health/lizmap/lizmap-pgmetadata-module

lizmap/lizmap-pgmetadata-module

Unpinned workflow actions and a low-confidence cache warning add supply-chain hygiene concerns. The package remains documented and supported by an organization with repository tests and release notes.

Latest 1.0.8

Packagist

63%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

100

Health Score Breakdown

Release history

The package has 17 releases over nearly six years, but none in the last 12 months, which is a meaningful maintenance concern for a dependency.

Repo commit activity

No commits or active maintainers were recorded in the last three months, indicating a recent maintenance lull despite the repository being unarchived.

Repo issue activity

Four issues and three pull requests remain open, while none were opened, closed, or merged in the last month; this suggests limited current activity but not abandonment alone.

Repo tooling

The project uses Make and Composer, but no security scanning tools were detected, leaving a modest transparency and maintenance gap.

Workflow audit

All six analyzed action references are unpinned, and the auditor reported a low-confidence high-severity cache-poisoning pattern in the release workflow; there are no untrusted checkouts or script injections, so this is a hygiene concern rather than a standalone severe risk.