Package Health/tourze/wechat-official-account-contracts

tourze/wechat-official-account-contracts

Its small scope, clear documentation, tests, and minimal runtime dependencies reduce adoption risk. The project is young and has limited security-process evidence, so pin this exact version and monitor future releases.

Latest 0.0.3

Packagist

78%

Total Score

Maintainer Stability

100

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package is 489 days old with three releases and two releases in the last 12 months, showing ongoing but modest maintenance rather than a mature release cadence.

Repo tooling

Composer build tooling is present, but no security-scanning tool was detected. For a small contracts package this is a process gap, not evidence of abandonment.

Security policy

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.

Version stability

Version 0.0.3 is not a stable major release, so compatibility guarantees are limited even though it is not marked as a prerelease.

Workflow audit

Both workflows were analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all 3 action references are unpinned, which weakens build reproducibility and supply-chain controls.