webforge/config

It has tests, a README, an MIT declaration, no runtime dependencies, and no install scripts. The narrow scope lowers integration burden, but pin this old release and prefer a maintained replacement if one is available.

Latest 1.0.2

Packagist

40%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has only three releases, all from September–October 2013, with no release in more than 12 years. That is strong evidence of abandonment, though the package is not deprecated.

Repo commit activity

There were zero commits and zero active maintainers in the last three months, consistent with a project that has had no visible development since 2013.

Repo package mention

The repository name does not match the package name and its README does not mention the package. That weakens confidence that the linked source is the intended project, despite the possibility of a naming or monorepo relationship.

Repo tooling

Composer is used for the build, which fits the package ecosystem, but no security-scanning tools are configured. This is a modest transparency gap rather than proof of unsafe code.

Security policy

The repository has no security policy. For a small, long-idle library this reduces vulnerability-reporting transparency, although it is not as serious as abandoned release activity.