uzdevid/php-telegram-bot

The source repository is active and the organization can provide continuity, while the package includes a useful README and no install-time scripts. Release publishing has stopped for about 15 months, activity comes from one contributor, and the repository lacks a security policy; workflow references are also unpinned.

Latest 3.0.0

Packagist

65%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has only four releases and none in the last 12 months; the latest registry release was about 15 months ago. This weakens confidence in ongoing release maintenance despite the repository showing newer activity.

Repo bus factor

All recent commit activity is concentrated in one contributor. Organization ownership offers some handoff capacity, but no second active contributor is shown to share the maintenance load.

Repo tooling

The project uses Composer for builds, but no security scanning tools are reported. This is a modest transparency gap rather than evidence of abandonment.

Security policy

No repository security policy is present, leaving disclosure and response expectations undocumented for a library that handles Telegram bot credentials and network requests.

Workflow audit

The sole workflow was fully analyzed with no dangerous triggers, untrusted checkouts, or audit findings. However, both action references are unpinned, which leaves workflow dependencies less reproducible.