mindbox/sdk

This release appears usable and backed by an active organization-owned repository, with a stable version, recent release, no deprecation, a substantial source tree, repository tests, and no install-time lifecycle scripts or dangerous workflow patterns. However, maintenance activity is currently weak: there were zero commits and zero active maintainers in the last 3 months, issue activity has largely stalled, and the package lacks licensing evidence and several security-transparency controls. These concerns warrant caution for long-term adoption, but the recent release, repository push, organizational backing, and compensating repository documentation keep it above the unhealthy range.

Latest 1.2.0

Packagist

68%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

License

No declared license and no license file were found in the artifact or repository, leaving the legal terms for dependency use unclear. This is a genuine transparency concern rather than an unknown metadata field because license_source is explicitly none.

Repo commit activity

There were zero commits and zero active maintainers in the last 3 months, a significant indication that day-to-day maintenance has currently stalled. The recent package release and repository push provide some compensating evidence, but not enough to make this fully healthy.

Repo issue activity

The repository has 8 open issues and 6 open pull requests, with no new or closed issues in the last month and only 1 merged pull request. This suggests backlog and limited recent project interaction, lowering confidence in responsive maintenance.

Repo tooling

Composer build tooling is present, but no security-scanning tools were detected. The absence of automated security scanning is a transparency and maintenance gap, though it is not by itself evidence that the package is unsafe.

Security policy

The repository has no security policy, so the process for reporting and handling vulnerabilities is not documented. This is a moderate transparency gap for a dependency but not a standalone disqualifier.