packaged/routing

This is a mature, stable MIT-licensed package with over seven years of release history, a current non-prerelease version, an unarchived organization-backed repository, comprehensive tests in both the artifact and repository, and no install-time lifecycle scripts. The main concern is maintenance continuity: although a release was published recently and pull requests have been merged, repository commit activity shows zero commits and zero active maintainers in the last three months. Very low repository popularity, absent security scanning and security policy, and unspecified workflow token permissions add transparency and operational cautions, but there is no deprecation or clearly severe abandonment indicator.

Latest 2.8.2

Packagist

72%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo commit activity

The repository recorded zero commits and zero active maintainers during the last three months. Despite a recent release and merged pull requests, this is a meaningful caution about current maintenance continuity.

Repo popularity

The repository has only 1 star, 2 forks, and 2 watchers. This limits popularity-based evidence of broad adoption, but popularity is supporting evidence and does not by itself indicate poor package health.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected. The missing scanning is a moderate security-process gap rather than evidence that the package is unsafe.

Security policy

No repository security policy was found, reducing transparency about vulnerability reporting and response procedures.

Token permissions

The only workflow lacks top-level token permissions. No write permissions were observed, but explicit least-privilege permissions are not declared, leaving a workflow-hardening gap.