magdv/psalm-plugin-yii2

The repository includes tests, build tooling, and automated security checks, while the package has a clear BSD-3-Clause license. Maintenance has gone quiet since July 2025, and all seven workflow actions are unpinned; pin this version only if its current compatibility meets your needs.

Latest 6.0.0

Packagist

62%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has 11 releases since June 2023, but none in the last 12 months and its latest release was July 2025. This indicates a currently quiet release cadence despite a previously active start.

Repo commit activity

The repository had zero commits and zero active maintainers in the last three months. Combined with the absence of releases in the last 12 months, this is a meaningful maintenance concern.

Repo popularity

The repository has two forks but no stars or watchers. Popularity is limited, but this is supporting evidence only and does not outweigh the maintenance and tooling signals.

Security policy

The repository has no security policy. That weakens vulnerability-reporting transparency, though the presence of Dependabot and Psalm provides some compensating security practice.

Workflow audit

The single workflow was fully analyzed with no reported dangerous findings, and it has no risky triggers or broad top-level write permissions. However, all seven action references are unpinned, leaving avoidable workflow supply-chain exposure.