orchestra/canvas-core
Tests and security controls add useful reassurance. Recent work is concentrated in one contributor, and all workflow actions are unpinned, so maintenance and build-integrity risks remain.
76%
Total Score
67
100
100
75
Health Score Breakdown
A post-autoload-dump install-time script is present, which increases installation complexity and requires trust in package behavior, though it is a common Composer mechanism.
One contributor made 100% of the 1 recent commit. Organization ownership provides some handoff capacity, but no second recently active contributor is shown.
Only 1 commit was recorded in the last 3 months, which is thin recent activity despite the strong release history.
All four workflows use read-only permissions and the audit found no injection or high-severity findings, but all 15 analyzed action references are unpinned, leaving avoidable action-integrity risk.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 Taylor Otwell |
| Mior Muhammad Zaki |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 composer/semver Version ^3.0 | — | — |
illuminate/console Version ^13.0 | — | — |
illuminate/support Version ^13.0 | — | — |
orchestra/sidekick Version ~1.1.23|~1.2.20 | — | — |
Weekly Downloads
Info
- Last Published
- 6 months ago
- Created
- 6 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.