swoft/config

Usable with caveats: the package is clearly licensed, tested, and backed by an organization, but it has had no release or repository activity for over five years. Treat it as a maintenance-risk dependency, especially if you need ongoing fixes or compatibility updates.

Latest v2.0.11

Packagist

58%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has 12 releases since 2019, but none in the last five years; the latest release was over five years ago. This is strong evidence of an unmaintained release line despite its previously regular cadence.

Repo commit activity

The repository recorded no commits and no active maintainers in the last three months, consistent with the long period since the last release. This substantially increases the risk that compatibility or defect fixes will not arrive.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected. The missing scanning is a modest transparency gap, while the long inactivity is the more significant concern.

Security policy

The repository has no security policy, leaving no documented process for reporting vulnerabilities. This is a genuine but secondary concern for a small, inactive component.

Token permissions

Both analyzed workflows omit top-level token permissions, so their permissions are not explicitly constrained at the workflow level. No write permissions were observed, making this a hygiene caution rather than a severe risk.