tempest/kv-store

This is a generally healthy release to depend on: it is stable, not deprecated, has a strong release cadence with 84 releases and 81 in the last 12 months, and the linked organization-owned repository is active and unarchived with 46 commits from two maintainers in the last three months. The main concerns are extreme contributor concentration, no repository security policy or security-scanning tooling, and the repository/package association is not fully explicit; these raise operational and transparency risk but do not outweigh the demonstrated maintenance activity and project backing.

Latest v3.19.2

Packagist

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo bus factor

Commit activity is highly concentrated: one contributor made 45 of 46 recent commits, leaving a thin practical bus factor. Organization ownership provides some ability to hand off maintenance, but the observed concentration remains a real risk.

Repo issue activity

There were no new or merged pull requests and no issue activity in the last month, which provides little evidence of broader community maintenance; however, this is partly offset by continued direct commit activity.

Repo package mention

The repository name does not exactly match the package name and no README package mention was collected, leaving some uncertainty that the repository is the canonical source. The dedicated tempest-kv-store URL makes this less concerning than an unrelated popular repository, but the association is not fully demonstrated.

Repo popularity

The repository has zero stars, forks, and watchers. This is weak supporting evidence, but popularity is not decisive and is outweighed by the active release and commit history.

Repo tooling

Composer build tooling is present, supporting reproducible project structure, but no security-scanning tools are configured. The missing scanning is a hygiene gap rather than evidence of abandonment.