ylsideas/feature-flags

It has a clear MIT license, a matching repository, tests, release notes, and a focused runtime dependency set. The repository is backed by an organization and includes a security policy, though its workflow checks need attention.

Latest v3.1.0

Packagist

70%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has been published since 2019 with 28 releases and one release in the last 12 months. This shows continued release activity, although the recent cadence is limited.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last 3 months, which is a meaningful maintenance concern despite the recent release.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected. The repository's separate security policy provides some compensating transparency, so this is a limited concern.

Workflow audit

All 17 analyzed action references are unpinned, weakening reproducibility, and the audit found a high-confidence bot-condition issue in the pull_request_target workflow. No untrusted checkout or script-injection sink was found, limiting the severity.