sulu/web-twig

sulu/web-twig is a generally healthy dependency: it has existed since 2017, uses a stable major release, is not deprecated, has a clear MIT license, a matching organization-owned repository, repository tests, documentation, and no install-time lifecycle scripts or dangerous workflow patterns. The main concerns are that repository commit activity was inactive over the last 3 months, only one release was published in the last 12 months, the repository lacks a security policy and security-scanning tools, and its workflow does not declare top-level token permissions. These are meaningful maintenance and security-hygiene gaps, but they are partly offset by the recent release, repository push, existing tests, and coherent package/repository structure.

Latest v2.7.0

Packagist

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has a long 3402-day history and 22 releases, but only 1 release in the last 12 months with a median interval of about 98 days indicates relatively slow ongoing release activity.

Repo commit activity

No commits and no active maintainers were observed during the last 3 months, which is a meaningful maintenance slowdown, although the repository was pushed recently and the package released recently.

Repo tooling

Composer build tooling is present, but no security-scanning tools were detected, leaving a security-hygiene gap in the repository.

Security policy

No repository security policy was found, reducing transparency about vulnerability reporting and response procedures.

Token permissions

The only workflow lacks top-level token permissions, so its effective GitHub Actions permission scope is less explicit than desirable, although no top-level write permissions were detected.