mlocati/chm-lib

The package has had no registry release since March 2020, although its repository was updated in June 2025 and includes tests and release notes. Its workflow leaves all six actions unpinned, weakening build reproducibility despite having no detected dangerous workflow findings.

Latest 1.3.0

Packagist

68%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The latest registry release was in March 2020, with no releases in the last 12 months, which lowers confidence in release maintenance. The repository was pushed in June 2025, providing some compensating evidence of continued project activity.

Repo commit activity

There were no commits and no active maintainers in the three months measured, which suggests currently limited development activity. The recent repository push provides only partial compensation because the measured period itself is inactive.

Repo tooling

Composer is used for builds, but no security scanning tools were detected, leaving a modest gap in repository hygiene.

Security policy

The repository has no security policy, reducing transparency about how security issues should be reported and handled.

Workflow audit

The sole workflow was fully analyzed with no dangerous triggers, sinks, or audit findings, and it avoids broad top-level write permissions. However, all six action references are unpinned, which weakens build reproducibility and supply-chain hygiene.