salient/toolkit

The package is clearly licensed, documented, and backed by a matching organization-owned repository with release notes and repository tests. Maintenance has slowed sharply, while all 24 workflow actions are unpinned and a high-confidence template-injection finding remains; pin this version cautiously.

Latest v0.99.81

Packagist

61%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has 411 releases over about 2 years and 7 months, but only 1 release in the last 12 months; the latest release was about 10 months ago, indicating a sharp slowdown.

Repo commit activity

The repository recorded 0 commits and 0 active maintainers in the last 3 months, which is a meaningful maintenance and abandonment concern despite the recent release history.

Repo issue activity

There were no new or closed issues or pull requests in the last month, while 23 issues remain open; this supports the evidence of limited recent activity.

Security policy

The linked repository has no security policy, leaving vulnerability-reporting and response practices undocumented; this is a transparency gap, not evidence of an unsafe release.

Workflow audit

All 24 analyzed action references are unpinned, and the audit found one high-confidence template-injection issue. The template issue is a hygiene concern on its own, while unpinned actions increase build reproducibility and supply-chain risk.

Vulnerabilities

We didn't find any vulnerabilities for this package.

Package versions

Maintainers

Luke Arms

Direct Dependencies

Dependency	Last Release	Score
psr/log Version ^1	—	—
lkrms/dice Version ^4.1.12	—	—
psr/container Version ^2	—	—
psr/http-client Version ^1	—	—
psr/http-factory Version ^1	—	—