spaze/nonce-generator

A clear README, matching source tree, repository tests, MIT licensing, and a recent release provide useful support. The project is small, recent commit activity is quiet, and both CI action references are unpinned, reducing maintenance and build reproducibility confidence.

Latest v4.0.3

Packagist

73%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has existed for about 9 years with 11 releases, but only one release occurred in the last 12 months and the median interval is about 7.6 months. Its long history and latest release provide some compensation, making this a modest maintenance concern.

Repo commit activity

There were zero commits and zero active maintainers during the last 3 months. The recent repository push and exact-version release notes provide some evidence of continuing project activity, but the observed short-term development pause lowers maintenance confidence.

Security policy

No repository security policy was found. This is a transparency gap, but it is partly offset by the repository's Dependabot configuration and is not severe for this small package.

Workflow audit

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injections, or audit findings. However, both of its two action references are unpinned, which weakens build reproducibility and supply-chain hygiene.