roave/better-reflection

roave/better-reflection 6.73.0 presents a strong overall dependency-health profile: it is a mature package with more than 10 years of history, 127 releases, 11 releases in the last 12 months, stable versioning, a non-deprecated registry status, an organization-backed repository, and a current repository push. The repository contains tests, extensive source and documentation, Composer build tooling, and Psalm security scanning, while the artifact has an MIT license and no install-time lifecycle scripts. The main concern is that repository commit activity shows zero commits and zero active maintainers over the last 3 months, despite recent releases and merged pull requests, which creates some uncertainty about ongoing development continuity. Missing security-policy metadata and workflow-level token permissions are additional hygiene gaps, but there is no observed dangerous workflow pattern.

Latest 6.73.0

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

100

Supply Chain

Health Score Breakdown

Repo commit activity

The repository reports zero commits and zero active maintainers over the last 3 months, a meaningful continuity concern; recent releases, a current push, and merged pull requests partly offset but do not eliminate this uncertainty.

Security policy

The repository has no security policy, reducing transparency about vulnerability reporting and response expectations; this is a hygiene gap rather than evidence of unsafe code.

Token permissions

Neither workflow declares top-level token permissions, leaving least-privilege intent less explicit; no workflow has declared top-level write access, so the concern is limited to configuration hygiene.