saidqb/core-php

The package is small but clearly identified, licensed, documented, and tested in the repository. Its workflow uses read-only job permissions, though both action references are unpinned and no security policy or scanning is present.

Latest v8.1.9

Packagist

58%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has had no releases in the last 12 months, and its latest release was about 20 months ago. Ten releases since July 2024 show some prior activity, but the current gap lowers confidence in ongoing maintenance.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last 3 months, consistent with the long release pause. The repository is not archived, but there is no recent development evidence to offset the inactivity.

Repo tooling

Composer is used as the build tool, which fits the package, but no security-scanning tool is configured. This is a modest transparency and maintenance gap rather than a severe risk.

Security policy

The linked repository has no security policy. For a small library this is a transparency gap, though the absence does not by itself indicate that the release is unsafe.

Workflow audit

The workflow was fully analyzed, has no untrusted checkout or script-injection findings, and uses read-only permissions. However, both of its two action references are unpinned, leaving avoidable build-integrity exposure.