lukasss93/smatch

The package is small and clearly documented, with tests, a matching repository, and an MIT license. Its single release and unchanged repository leave maintenance and future compatibility uncertain. Pin v1.0 only if its PHP 7.3–7.4 support fits your project.

Latest v1.0

Packagist

45%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Release history

This is the only release, published over 5 years ago, with no releases in the last 12 months. The release notes document the initial release, but there is no later evidence of maintenance.

Repo commit activity

The repository recorded 0 commits and 0 active maintainers in the last 3 months, consistent with a project that has been inactive since its initial release. Its small scope partly reduces maintenance demand but does not remove abandonment risk.

Security policy

The repository has no security policy, which weakens vulnerability-reporting transparency. This is a hygiene concern, not evidence that the release is unsafe by itself.

Workflow audit

Both workflows were analyzed without high-confidence findings or untrusted execution paths. However, all 4 action references are unpinned, leaving avoidable dependency-integrity risk in the build workflows.