sbominator/sbom-lib

Repo commit activitydanger

There were zero commits and zero active maintainers in the last three months, consistent with a project that has gone quiet. This is the strongest maintenance concern in the available evidence.

Release historycaution

The package has had no release in about 18 months, despite eight releases concentrated around its March 2025 launch. This materially raises abandonment risk, though the existing release history shows an initially active project.

Repo issue activitycaution

There has been no new or closed issue activity in the last month, although two pull requests remain open. This suggests limited ongoing stewardship but is weaker evidence than the absent commit activity.

Repo popularitycaution

The repository has zero stars and one fork, indicating a small user and contributor footprint. Popularity is only supporting evidence, so this modestly lowers confidence in long-term maintenance rather than determining the verdict.

Repo toolingcaution

Composer is used as the build tool, but no security scanning tool is configured. The missing scanning is a hygiene gap, not evidence that the package is unmaintained.