zalas/phpunit-injector

The package is licensed, documented, and tested in its repository. Release and commit activity has slowed sharply, while all five workflow actions are unpinned and one is archived. It remains a stable, non-deprecated package with a matching source repository.

Latest v2.5.1

Packagist

60%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The latest registry release was in January 2024, about 2 years 8 months before collection, with no releases in the last 12 months. This is a meaningful maintenance concern despite a previously regular release interval.

Repo commit activity

There were no commits and no active maintainers in the three months before collection. Combined with the long release gap, this points to slowed maintenance and raises abandonment risk.

Repo tooling

The repository uses Composer, Make, and Box for builds, showing established packaging tooling, but no security-scanning tools were detected.

Security policy

The repository has no security policy. This is a transparency and vulnerability-reporting gap, though it is less severe for a small PHPUnit development dependency.

Workflow audit

The sole workflow was fully analyzed with no untrusted checkout or script-injection findings, but all five action references are unpinned and one uses an archived action. The missing top-level permissions block is acceptable on its own and no write-wide token was found.