nette/component-model

The package is clearly documented and licensed, with tests in the repository and no install-time scripts. Workflow references are all unpinned, and recent work comes from one contributor, so maintenance and build reproducibility deserve attention.

Latest v4.0.1

Packagist

80%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

100

Health Score Breakdown

Repo bus factor

All 1 recent commit came from a single contributor, giving a 100% top-contributor share. Organization ownership provides some handoff capacity, but no second recently active contributor is shown.

Repo commit activity

Only 1 commit was recorded in the last 3 months, showing limited recent repository activity. The release history and organization backing partly offset this, but the short-term maintenance signal is still weak.

Repo tooling

Composer build tooling is present, but no security-scanning tool was detected. The repository's separate security policy provides some transparency, so this is a minor hygiene concern rather than a severe risk.

Workflow audit

All 3 workflows were analyzed successfully with no dangerous triggers, untrusted checkouts, script injections, or audit findings. However, all 13 analyzed action references are unpinned, which weakens build reproducibility and introduces avoidable maintenance risk.