openeuropa/oe_newsroom

This is a healthy, well-structured release with an established history, a current stable version, active repository maintenance, organizational backing, tests, documentation, changelog coverage, and a clear license. The repository is not archived or deprecated, has three active maintainers and 37 commits in the last 3 months, and its CI workflow shows no analyzed dangerous patterns. The main reservations are the roughly 324-day median release interval, absent repository security policy, and unspecified top-level GitHub Actions token permissions; these are meaningful hygiene gaps but are outweighed by current development activity and strong package transparency.

Latest 1.2.0

Packagist

86%

Total Score

Maintainer Stability

100

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Lifecycle scripts

The package uses post-install-cmd and post-update-cmd scripts, which increase installation-time behavior and warrant review when depending on the release. No provided signal shows these scripts are malicious or unsafe, so this is a caution rather than a severe risk.

Release history

The package has existed for about 4 years, with 6 releases and 2 releases in the last 12 months. The roughly 324-day median interval is slower than highly active projects, but the recent releases and repository activity indicate it is not abandoned.

Repo tooling

Composer build tooling is present, but no security-scanning tool was detected. The missing scanner is a hygiene gap, while the separate workflow analysis found no dangerous workflow patterns.

Security policy

No SECURITY.md or equivalent security policy was detected, leaving vulnerability-reporting and response expectations less transparent. This is a maintenance and transparency gap, not evidence of an unsafe release by itself.

Token permissions

The sole workflow does not declare top-level token permissions, so its effective GitHub Actions token scope is less explicit than preferred. No workflow with explicit write permissions was detected, limiting the severity of this gap.