silverstripe/lumberjack

The repository is backed by an organization, has a clear license, tests, release notes, and recent package releases. Recent repository work is concentrated in one contributor, and all seven workflow references are unpinned, so maintenance and build reproducibility deserve attention.

Latest 4.1.1

Packagist

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo bus factor

All one recent commit came from a single contributor, giving a 100% top-contributor share. Organization backing partly mitigates handoff risk, but recent activity remains concentrated.

Repo commit activity

Only one commit was recorded in the last 3 months, indicating limited recent direct development activity. The recent release history and merged pull requests provide some compensating evidence, but maintenance momentum is still worth watching.

Repo tooling

Composer is used for builds, but no security scanning tools were detected. The missing scanning coverage is a modest transparency and maintenance gap, not evidence of an unsafe release.

Security policy

The repository has no security policy. This weakens vulnerability-reporting transparency, though it does not indicate abandonment or make the release unfit on its own.

Workflow audit

All seven workflow references are unpinned, which weakens build reproducibility. The audit analyzed every workflow, found no untrusted checkout or script-injection sink, and six workflows use read-only permissions; the pull_request_target trigger is therefore not dangerous on its own.