netcommons/groups

Nearly three years without a registry release or recent repository commits limits confidence in ongoing maintenance. The organization-backed repository has tests, a matching package, and a stable release, but its workflows use unpinned actions and include an archived action.

Latest 3.3.7.0

Packagist

58%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The latest release was nearly three years ago, with no releases in the last 12 months, despite a history of 17 releases. This indicates stalled maintenance and lowers confidence in future fixes.

Repo commit activity

There were no commits and no active maintainers in the last three months, consistent with the long release gap. This is a real maintenance concern, though the repository remains available and unarchived.

Repo tooling

Composer is used for builds, but no security scanning tools were detected. The missing scanning is a hygiene gap, not evidence that the release is unsafe by itself.

Security policy

The repository has no security policy, leaving vulnerability-reporting expectations undocumented. This weakens transparency for a maintained dependency.

Workflow audit

All 9 analyzed action references are unpinned, and the audit found a high-confidence medium-severity archived action in the release workflow. The workflows had no dangerous triggers or untrusted checkouts, which limits the impact.

Vulnerabilities

We didn't find any vulnerabilities for this package.

Package versions

Maintainers

NetCommons Community

Direct Dependencies

Dependency	Last Release	Score
netcommons/m17n Version @dev	—	—
netcommons/files Version @dev	—	—
netcommons/rooms Version @dev	—	—
netcommons/users Version @dev	—	—
cakedc/migrations Version ~2.2	—	—