szopen/similarity

The library includes a focused test suite, a clear README, and release notes for this version. Its MIT declaration, minimal runtime dependencies, and read-only workflow permissions are reassuring, though the workflow uses unpinned actions.

Latest v1.0.1

Packagist

67%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has only two releases, both published on the same day, with no later release activity over its 317-day lifetime. This limits evidence of sustained maintenance.

Repo commit activity

There were no commits and no active maintainers in the past three months. Combined with the short release history, this is a meaningful maintenance concern.

Repo tooling

The project uses Composer, but no security-scanning tooling was detected. This is a modest transparency and maintenance gap rather than evidence of an unsafe release.

Security policy

The repository has no security policy. That weakens the project's documented process for reporting and handling vulnerabilities.

Workflow audit

The single workflow was fully analyzed, uses read-only permissions, and has no audit findings, but both action references are unpinned. Unpinned actions leave the build exposed to upstream reference changes.