typhoon/change-detector

The package has clear documentation, source tests, release notes, and only one runtime dependency. Its organization-backed repository is not archived, but no commits or releases have appeared for nearly two years and all six workflow actions are unpinned. Pin 0.4.5 if its current behavior fits your needs.

Latest 0.4.5

Packagist

58%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has four releases over about two years, but the latest was on November 21, 2024 and there were no releases in the following 12 months. This is meaningful evidence of a potentially inactive release line.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the long gap since the last release. This lowers confidence in ongoing maintenance.

Security policy

The linked repository has no security policy. This is a transparency gap for reporting vulnerabilities, though it does not by itself indicate abandonment or unsafe code.

Workflow audit

Both workflows were analyzed successfully with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all six action references are unpinned, leaving them exposed to upstream changes; missing top-level permissions blocks are acceptable on their own.