log1x/sage-svg

Project backingcaution

The registry namespace and repository are owned by the same individual account, so the package has direct ownership alignment but no organizational backing shown by this signal. That is a modest bus-factor concern rather than a severe risk.

Release historycaution

The package has 13 releases since July 2019, but none in the last 12 months and the latest release was nearly two years ago. This is meaningful evidence of slowed maintenance for a library dependency.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months, consistent with the absence of registry releases in the last year. This lowers confidence in timely fixes.

Repo issue activitycaution

There were no new or closed issues or pull requests in the last month, with three open issues. The low issue volume is not severe, but it provides little evidence of active maintenance.

Repo toolingcaution

The repository uses Composer but has no detected security-scanning tooling. For a small PHP package this is a modest transparency and maintenance gap, not evidence of a defect.