Package Health/palantirnet/drupal-rector

palantirnet/drupal-rector

This release appears healthy and suitable for dependency use: it has a mature history spanning over 6 years, 60 releases including 16 in the last 12 months, a current stable version, an active non-archived organization-owned repository, substantial test and documentation coverage, and recent commit activity. The main concerns are concentrated recent contribution activity, with one contributor responsible for about 98.7% of commits, and repository security-hygiene gaps including no security scanning, no security policy, and no explicit top-level workflow permissions. These concerns warrant normal maintenance and supply-chain review but do not outweigh the strong evidence of active development, release continuity, and project transparency.

Latest 1.1.3

Packagist

88%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo bus factor

Recent work is highly concentrated: one contributor made about 98.7% of 77 commits, while the second made one commit. Organization ownership provides some handoff capacity, but the observed concentration remains a genuine continuity risk.

Repo tooling

The repository uses Composer for builds, but no security scanning tools were detected. The build tooling is adequate, while the missing security automation is a supply-chain hygiene gap.

Security policy

No repository security policy was found. This reduces transparency about vulnerability reporting and response procedures, though it is a documentation gap rather than evidence of abandonment.

Token permissions

All four workflows lack top-level permissions declarations. No workflow requests top-level write access, but explicitly constraining permissions would provide stronger CI security hygiene.