snapshotpl/shipx-php-sdk

The README is substantial, the release is licensed, and the repository is still available. One maintainer, no security scanning, and unpinned workflow actions add ongoing maintenance and build-trust concerns.

Latest 2.0

Packagist

45%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has had no releases in more than four years, despite 10 releases overall. This long gap is substantial evidence of abandonment risk for an API SDK.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the release history showing no releases since February 2022.

Repo popularity

The repository has zero stars, forks, and watchers, providing no supporting evidence of an active user or contributor community. Popularity is only supporting evidence, but its absence adds to the maintenance concern here.

Security policy

The repository has no security policy, leaving no documented route for reporting vulnerabilities or describing security handling. This is a transparency gap, though it is less severe than the inactivity evidence.

Workflow audit

Both workflows were analyzed successfully with no dangerous triggers, untrusted checkouts, or audit findings. However, all 8 action references are unpinned, which weakens build reproducibility and supply-chain hygiene.