The repository is still active under organizational ownership, with a clear license, release notes, tests in source, and read-only workflow permissions. Long release silence, minimal recent commits, absent security policy, and unpinned workflow actions make maintenance and build provenance worth checking before adoption.
62%
Total Score
63
100
81
75
The package has 29 releases since July 2015, but its latest registry release was in April 2021 and there were no releases in the last 12 months. This long release gap materially raises abandonment and compatibility risk.
All recent commits came from one contributor, giving a complete short-term concentration of activity. Organizational ownership provides some handoff capacity, but no second active contributor is shown.
Only one commit was recorded in the last three months. That is some evidence of ongoing work, but it is too little activity to offset the long release gap.
The repository has five open issues and five open pull requests, but none were opened or merged in the last month. Open work without recent movement supports a maintenance caution.
Composer build tooling is present, but no security scanning tool was detected. For a library with an established build, this is a modest transparency and maintenance gap.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
diff/diff Version ~3.2 | — | — |
wikimedia/assert Version ~0.2.2|~0.3.0|~0.4.0|~0.5.0 | — | — |
wikibase/data-model Version ~9.0|~8.0 | — | — |
data-values/data-values Version ~3.0|~2.0|~1.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.