sspooky13/yaml-standards

The package has clear documentation, tests, a changelog, matching source, MIT licensing, and no install-time scripts. Its single-maintainer base, no commits in three months, unresolved issues, and unpinned workflow actions warrant checking support before adoption.

Latest 9.2.1

Packagist

67%

Total Score

Maintainer Stability

Dependencies

100

Maturity

100

Supply Chain

Health Score Breakdown

Maintainers

Only one registry account has publishing access, creating a thin release-control base. The repository is user-owned, so there is no organizational backing signal to compensate for that concentration.

Repo commit activity

There were no commits and no active maintainers in the last three months. Although the repository was pushed in July and releases continue, the recent development pause lowers confidence in ongoing maintenance.

Repo issue activity

The repository has 16 open issues and one open pull request, with no issues or pull requests closed or merged in the last month; this suggests unresolved maintenance demand.

Security policy

The repository has no security policy, leaving vulnerability reporting and response expectations unclear. Existing security scanning helps, but does not replace a documented process.

Workflow audit

All six analyzed action references are unpinned, weakening build reproducibility. The reported cache-poisoning findings are low-confidence hygiene warnings, so they do not independently create a severe risk.

Vulnerabilities

We didn't find any vulnerabilities for this package.

Package versions

Maintainers

Peter Turek

Direct Dependencies

Dependency	Last Release	Score
symfony/yaml Version ^4.2.0 \|\| ^5.0 \|\| ^6.0 \|\| ^7.0 \|\| ^8.0	—	—
sebastian/diff Version ^3.0 \|\| ^4.0 \|\| ^5.0 \|\| ^6.0 \|\| ^7.0	—	—
symfony/config Version ^4.2.0 \|\| ^5.0 \|\| ^6.0 \|\| ^7.0 \|\| ^8.0	—	—
symfony/console Version ^4.2.0 \|\| ^5.0 \|\| ^6.0 \|\| ^7.0 \|\| ^8.0	—	—