Package Health/stevegrunwell/time-constants

stevegrunwell/time-constants

Its single runtime dependency, MIT license, tests, and release notes make the package easy to adopt. Workflow references are unpinned and the repository has no security policy, which weakens maintenance hygiene.

Latest v2.0.2

Packagist

65%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has 8 releases since March 2018, but none in the last 12 months and the latest release was about 2 years ago. This is a meaningful maintenance concern for a dependency, despite its stable history.

Repo commit activity

There were no commits and no active maintainers in the last 3 months, consistent with a repository that has been quiet for about 2 years. This lowers confidence in ongoing maintenance.

Repo tooling

The project uses Make and Composer but reports no security-scanning tools. For a small library this is a hygiene gap rather than a severe risk.

Security policy

The repository has no security policy. This weakens transparency about vulnerability reporting, though the package's small and focused scope limits the impact.

Workflow audit

Both workflows were analyzed with no dangerous triggers, untrusted checkouts, or audit findings, but all 6 action references are unpinned. Missing top-level permissions are acceptable here, while fully unpinned actions remain a supply-chain hygiene concern.