smhg/sepa-qr-data

Clear documentation, tests, MIT licensing, and a stable major release support adoption. The repository lacks security scanning, and its workflow actions are not pinned, so maintenance and build-integrity checks are limited.

Latest v3.0.0

Packagist

68%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has six releases over about five years, but none in the last 12 months; the latest release was about 15 months ago. This indicates slow maintenance for a package with a stable scope.

Repo commit activity

There were no commits and no active maintainers in the last three months, consistent with the roughly 15-month gap since the last repository push. This leaves current maintenance capacity uncertain.

Repo tooling

Composer build tooling is present, but no security scanning tool was detected. For a small library this is a modest transparency and maintenance gap, not evidence of an unsafe release by itself.

Security policy

The linked repository has no security policy, leaving vulnerability reporting and response expectations unspecified. This is a transparency gap, though the package's narrow scope limits its effect.

Workflow audit

The single workflow was fully analyzed with no untrusted checkouts, script injection, or high-severity findings, and it does not grant top-level write access. However, all three action references are unpinned, which weakens build reproducibility and supply-chain hygiene.