swoft/aop

The source includes tests, clear licensing, and organization backing, but its workflows use five unpinned actions and no security policy is published. Maintenance capacity is uncertain because repository activity has stopped, despite the package remaining non-archived and stable.

Latest v2.0.11

Packagist

58%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The latest release was over five years ago, with no releases in the last 12 months; the earlier median interval of about 45 days shows this is a prolonged halt rather than a normal cadence.

Repo commit activity

There were no commits and no active maintainers in the last three months, consistent with the long release gap and increasing abandonment risk.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected, leaving a modest transparency and maintenance gap.

Security policy

The repository has no security policy, so users are given no documented process for reporting vulnerabilities or receiving security fixes.

Workflow audit

Both workflows were analyzed successfully with no untrusted checkouts, injection findings, or broad top-level write permissions. However, all five action references are unpinned, which is a workflow hygiene weakness.