phrozenbyte/pico

No commits or active maintainers were recorded in the last three months, and the release documentation calls this an unsupported fork of an end-of-life project. The package is licensed and has a substantial README, changelog, and security policy, but workflow references are all unpinned.

Latest v3.0.0

Packagist

35%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Package scaffolding

The package includes a substantial README, changelog, and release notes, but those notes explicitly identify this as an unsupported fork and the README says Pico development stopped long ago and advises against new websites. The documentation is transparent, yet it confirms substantial abandonment risk.

Repo commit activity

The repository recorded 0 commits and 0 active maintainers during the last three months. That indicates no current maintenance capacity for a package already described as unsupported.

Release history

All 37 releases occurred within a single day, with a median interval of 0 days, which suggests a concentrated fork publication burst rather than an established ongoing release cadence.

Repo tooling

The repository uses Make and Composer, but has no security scanning tools. This is a modest transparency and maintenance gap, though it is partly offset by the repository having a security policy.

Workflow audit

All 13 analyzed action references are unpinned, leaving workflow dependencies exposed to upstream changes. The audit found no dangerous triggers, untrusted checkouts, script injection, or high-severity findings, which limits this to a hygiene concern.