s9e/bencode

The stable major version, MIT license, repository tests, and small dependency footprint support predictable adoption. Unpinned workflow actions and the lack of a security policy leave avoidable maintenance and supply-chain hygiene gaps.

Latest 2.3.2

Packagist

66%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has 25 releases since May 2017, but none in the last 12 months; the latest release was in April 2024. This indicates a substantial maintenance slowdown, though the established release history is a mitigating factor.

Repo commit activity

The repository had no commits and no active maintainers in the last three months. Combined with the absence of releases in the last 12 months, this lowers confidence in active maintenance.

Repo tooling

Composer is used for builds, but no security scanning tool is reported. The missing scanning coverage is a modest repository hygiene gap rather than evidence of an unsafe release.

Security policy

The repository has no security policy, leaving no documented process for reporting or handling vulnerabilities. This is a transparency and maintenance gap for a parser intended to process hostile input.

Workflow audit

The single workflow was fully analyzed with no detected sinks or high-severity findings, but both action references are unpinned. The missing top-level permissions block is acceptable on its own; unpinned actions remain a supply-chain hygiene concern.