roots/support

The repository shows no commits in the last three months and has no security policy, while its sole workflow uses an unpinned action. MIT licensing, organization backing, release notes, and a small dependency profile provide useful transparency.

Latest v1.0.1

Packagist

65%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has only two releases over roughly seven years, with no release in the last 12 months and a median interval of about 4.6 years. This is a meaningful maintenance concern, although the linked repository remains active enough to avoid treating the package as abandoned.

Repo commit activity

There were no commits and no active maintainers in the last three months. That weakens evidence of ongoing maintenance, even though the repository is not archived.

Repo tooling

Composer is used for the build, but no security scanning tooling was detected. The missing scanning is a modest transparency and maintenance gap.

Security policy

The repository has no security policy, leaving vulnerability reporting and handling expectations undocumented.

Workflow audit

The sole workflow was fully analyzed with no dangerous triggers or audit findings, but its one action reference is unpinned. The absence of a top-level permissions block is acceptable on its own.