patrick-barreto/dot-env

The source remains available and the release includes notes, while its stable version and single runtime dependency keep adoption simple. About 18 months without a release, no recent commits, weak documentation, and permissive unpinned workflow actions increase maintenance and supply-chain concerns.

Latest v1.0.1

Packagist

48%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Package scaffolding

The package has no README, tests, or changelog, which weakens documentation and verification for a library consumers must integrate. Release notes for version 1.0.1 provide limited compensating documentation.

Release history

Only two releases exist, with no release in about 18 months and none in the last 12 months. This indicates a small, potentially inactive maintenance history.

Repo commit activity

There were no commits and no active maintainers in the last three months, consistent with the long gap since the latest release and raising abandonment concerns.

Repo package mention

The repository name does not match the package name, and no README package mention was available. That makes the source-package association less transparent, although naming differences can occur for small packages.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected, leaving repository security hygiene weaker than it could be.