tflori/envparser

The release has a clear README, extensive tests, and release notes, while its small dependency surface keeps adoption straightforward. Maintenance is active, but the project relies on one contributor and its seven workflow actions are unpinned.

Latest v1.1.1

Packagist

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo bus factor

All four recent commits came from one contributor, leaving maintenance dependent on a single person. The repository is user-owned rather than organization-owned, so there is no provided backing evidence to offset that concentration.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected. That is a hygiene gap rather than evidence of abandonment.

Security policy

The repository has no security policy. This reduces vulnerability-reporting transparency but is not severe enough to make the release unfit on its own.

Version stability

The assessed version is a stable major release and is not a prerelease. The recent prerelease share is high, so release maturity is somewhat mixed.

Workflow audit

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injections, or audit findings. However, all seven action references are unpinned, which leaves the build exposed to action changes over time.