swow-cloud/xr

The repository includes tests, a matching README, a license, and automated scanning. Its long-standing lack of releases or commits and entirely unpinned workflow actions make maintenance and build reproducibility concerns; pin 0.1.3 only if you can accept that risk.

Latest 0.1.3

Packagist

42%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has had no release in more than four years, with zero releases in the last 12 months. This is strong evidence of abandonment risk despite the package not being deprecated.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the stale registry history. The linked repository is present and not archived, but there is no observed recent maintenance.

Security policy

The repository has no security policy, reducing transparency for vulnerability reporting. This is partly offset by the repository's configured Sonar security scanning, but the missing disclosure process remains a minor concern.

Workflow audit

All 18 analyzed action references are unpinned, which weakens build reproducibility, and one high-confidence medium-severity finding identifies an archived action. The workflows have no untrusted checkout or script-injection findings, limiting the risk to hygiene rather than an acute workflow threat.

Vulnerabilities

We didn't find any vulnerabilities for this package.

Package versions

Maintainers

Rodolfo Berrios

Direct Dependencies

Dependency	Last Release	Score
chevere/trace Version ^0.1	—	—
chevere/chevere Version ^0.3	—	—
chevere/var-dump Version ^0.1	—	—
samejack/php-argv Version ^1.0	—	—
rodber/php-sse-react Version ^0.1	—	—