orchid/fortify

The repository has no recent commit or issue activity, and the workflow audit found a high-confidence unpinned container image. The MIT license, release notes, matching repository, and security policy provide useful transparency, but the long inactivity makes this a risky dependency.

Latest 0.0.12

Packagist

43%

Total Score

Maintainer Stability

Maturity

Supply Chain

100

Health Score Breakdown

Release history

The package has had no release in over three years: its latest release was May 28, 2023, despite 12 releases overall. This strongly raises abandonment risk, although the earlier median interval of about 44 days shows it was previously maintained.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last three months. Combined with the release history, this is strong evidence of prolonged abandonment risk.

Repo issue activity

There are five open issues but no new or closed issues and no pull-request activity in the last month. This supports the view that maintenance is currently inactive.

Repo tooling

The project uses Composer, but no security-scanning tooling was detected. That is a modest transparency and maintenance gap rather than evidence that the package is unsafe by itself.

Version stability

Version 0.0.12 is not on a stable major version, so its API maturity is limited. It is not marked as a prerelease, which partly offsets the concern but does not remove the immaturity signal.