tangible/ddd

Documentation and tests support integration, and the repository remains active with contributions from three maintainers. Install-time scripts, absent security scanning, and unpinned workflow actions warrant routine review.

Latest v0.6.6

Packagist

82%

Total Score

Maintainer Stability

100

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Lifecycle scripts

The package runs post-install and post-update Composer scripts, which increases installation-time behavior and deserves review, but this signal alone does not indicate unsafe or unhealthy maintenance.

Repo tooling

Composer build tooling is present, but no security-scanning tools were detected. This is a modest process gap rather than evidence of abandonment.

Security policy

The repository has no SECURITY.md policy, reducing transparency about vulnerability reporting and response procedures. This is a hygiene gap, not a standalone dependency-blocking risk.

Version stability

Version v0.6.6 is not a stable major release, but it is not a prerelease and recent releases contain no prerelease versions, making the maturity caveat limited.

Workflow audit

The single workflow was fully analyzed with no untrusted checkout, injection, or audit findings, and it does not grant top-level write permissions. Both action references are unpinned, which leaves workflow dependencies less reproducible and is a minor supply-chain hygiene gap.

Vulnerabilities

We didn't find any vulnerabilities for this package.

Package versions

Maintainers

Tangible

Direct Dependencies

Dependency	Last Release	Score
symfony/config Version ^7.4	—	—
league/tactician Version ^2.0-rc1	—	—
makinacorpus/query-builder Version ^1.6	—	—
symfony/dependency-injection Version ^7.4	—	—
woocommerce/action-scheduler Version ^3.9	—	—