sylapi/courier-gls

Tests, a matching repository, and a clear MIT license make the package easier to inspect and adopt. The organization-backed project has no reported security scanning or policy, and its workflow uses three unpinned actions. Pin this version while confirming future maintenance.

Latest v3.0.4

Packagist

68%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has 29 releases since February 2020, but only one release in the last 12 months; the latest was about 9 months ago. This suggests slower maintenance despite a substantial release history.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last 3 months. Combined with only one registry release in the last year, this raises a meaningful maintenance risk.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected. The build setup is established while automated security coverage is limited.

Security policy

The repository has no published security policy. This weakens transparency around vulnerability reporting, although it is not evidence that the package is unsafe.

Workflow audit

The single workflow was fully analyzed with no untrusted checkouts, script injection, or high-severity findings. However, all 3 action references are unpinned, which leaves the build exposed to changing upstream action code.