ltqio/upyun-php-sdk

The project has had no commits from any maintainer in the last three months, and releases are widely spaced. Its MIT licensing, clear README, repository tests, and changelog provide useful transparency, but the workflow uses two unpinned actions.

Latest v1.1.0

Packagist

61%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has only two releases over 460 days, with a median interval of about 303 days and one release in the last 12 months. This indicates a sparse maintenance cadence, though the latest release is recent enough to avoid an abandonment conclusion.

Repo commit activity

There were zero commits and zero active maintainers in the last three months. The repository is not archived, but this recent inactivity raises maintenance and abandonment concerns for an SDK.

Repo tooling

Composer and Robo are used for project tooling, but no security scanning tool is present. That is a modest transparency and maintenance gap rather than evidence of an unsafe release.

Workflow audit

The single workflow was fully analyzed, uses read-only permissions, and has no dangerous sinks or audit findings. However, both of its two action references are unpinned, leaving avoidable build-integrity risk.