riesenia/pohoda

This is a healthy, actively maintained release with a long history since 2017, 74 releases, six releases in the last 12 months, a stable non-prerelease version, and a repository that was updated at assessment time. The organization-backed repository contains substantial source code, specifications, CI configuration, and the package identity is clearly matched. The main concerns are modest recent activity, no repository security policy or security scanning, and workflow permissions that are not explicitly restricted; these warrant review but do not outweigh the strong release and repository evidence.

Latest v1.27.0

Packagist

86%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo commit activity

The repository recorded 3 commits in the last 3 months from 2 active maintainers. Recent work is present, but the volume is modest for a package with ongoing releases.

Repo issue activity

There are 3 open issues and 4 open pull requests, with 1 pull request merged in the last month, but no new or closed issues and no new pull requests during that period. This indicates some activity but a relatively quiet issue-management cadence.

Repo tooling

Composer build tooling is present, but no security-scanning tools were detected. The missing scanning is a transparency and security-hygiene gap, though it is not evidence of abandonment.

Security policy

The repository has no SECURITY.md or other detected security policy, leaving vulnerability-reporting expectations unclear.

Token permissions

The only workflow lacks top-level token permissions, and no workflow explicitly declares read-only permissions. Although no write permissions are observed, the absence of an explicit restrictive declaration is a workflow-hygiene gap.