Package Health/prometee/vies-client-bundle

prometee/vies-client-bundle

The bundle has a clear README, tests, release notes, an MIT declaration, and no install-time scripts. Its small maintainer base, no commits in three months, and fully unpinned workflow references warrant caution for long-term use.

Latest v3.0.0

Packagist

67%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Maintainers

Only one registry account has publish access. The linked repository is user-owned rather than organization-backed, so the narrow publisher base leaves limited visible continuity capacity.

Release history

The package has existed since 2018 with nine releases, but it had no releases in the last 12 months; this suggests slowing maintenance rather than abandonment on its own.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last three months. That is a meaningful maintenance warning, despite the repository not being archived.

Security policy

No repository security policy was found. This is a transparency gap, but it is not severe enough by itself to outweigh the package's other evidence.

Workflow audit

All three analyzed action references are unpinned, which weakens build reproducibility. The reported cache-poisoning finding has low confidence and is hygiene at most; the audit otherwise analyzed the single workflow completely.

Vulnerabilities

We didn't find any vulnerabilities for this package.

Package versions

Maintainers

Francis HILAIRE

Direct Dependencies

Dependency	Last Release	Score
symfony/config Version ^6.4\|^7.2	—	—
symfony/validator Version ^6.4\|^7.2	—	—
symfony/http-kernel Version ^6.4\|^7.2	—	—
prometee/vies-client Version ^1.0	—	—
symfony/dependency-injection Version ^6.4\|^7.2	—	—