packaged/querybuilder

This release is usable but warrants moderate caution. The package has a long history with 65 releases since 2014, a current non-prerelease version, an MIT declaration, tests in both the artifact and repository, a substantial source tree, no install-time scripts, no deprecation, and an organization-owned repository that clearly matches the package. However, only one release occurred in the last 12 months and the repository recorded no commits or active maintainers in the last three months, indicating potentially slowing maintenance. The repository also lacks security scanning, a security policy, and explicit workflow token permissions; these are transparency and hardening gaps rather than evidence of maliciousness.

Latest 0.24.1

Packagist

72%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has existed for 4,349 days and has 65 releases, supporting maturity, but only one release occurred in the last 12 months, which suggests maintenance has slowed substantially.

Repo commit activity

There were zero commits and zero active maintainers in the last three months. This is a meaningful maintenance concern, partially offset by the recent package release and repository activity shown elsewhere.

Repo popularity

Seven stars, one fork, and one watcher indicate a small user and contributor footprint. Popularity is supporting evidence only, so this modest reach is a caution rather than a decisive health failure.

Repo tooling

Composer build tooling is present, but no security scanning tools are configured. The missing scanning is a hardening gap, while the package's CI and tests provide some compensating engineering evidence.

Security policy

The repository has no security policy. This reduces vulnerability-reporting transparency, though it is a documentation gap rather than evidence that the package is unsafe.