phpcq/gnupg

The package is small and focused, with tests, a clear license, and organization backing. Its sparse release history and no commits in the last three months make long-term maintenance less certain.

Latest 1.0.3

Packagist

68%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has only four releases since September 2020, with a median interval of about 12 months, indicating a deliberately sparse maintenance cadence. Two releases in the last 12 months provide some evidence of continued publishing.

Repo commit activity

There were no commits and no active maintainers in the last three months. This is a meaningful maintenance concern, although the repository had a push in June and the registry shows two releases in the last 12 months.

Security policy

No security policy was found, leaving vulnerability reporting and response expectations undocumented for a security-sensitive GnuPG wrapper.

Workflow audit

The sole workflow was fully analyzed with no high-confidence audit findings and no untrusted checkout or script-injection paths. However, all six action references are unpinned, which weakens build reproducibility, while the lack of a top-level permissions block is acceptable on its own.