nannehuiges/jsend

The package is documented, tested, licensed, and has a recent release with a matching source repository. Maintenance activity is currently quiet, and all 15 workflow action references are unpinned, leaving meaningful upkeep and build-integrity concerns.

Latest v6.0.1

Packagist

68%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has existed for over 10 years and released once in the last 12 months, with the latest release about 7 months before collection. That shows continuity but a slower current cadence.

Repo commit activity

The repository recorded zero commits and zero active maintainers over the last 3 months. The same-day release is some compensating evidence, but ongoing maintenance capacity remains uncertain.

Repo tooling

Composer and Make are used for project tooling, but no security-scanning tools were detected. For a small library this is a hygiene gap rather than evidence of abandonment.

Security policy

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.

Workflow audit

All five workflows were analyzed without high- or medium-severity findings, and no untrusted checkout or script-injection paths were found. However, all 15 action references are unpinned, which weakens build reproducibility and supply-chain hygiene.