Package Health/zoon/commonmark-ext-youtube-iframe

zoon/commonmark-ext-youtube-iframe

The package is licensed, tested, and has a clear repository with a small dependency footprint. Its narrow scope makes the maintenance gap easier to assess, but the absence of security controls and pinned workflow actions leaves avoidable upkeep risk.

Latest 2.0.0

Packagist

61%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The latest release was published over four years ago, with no releases in the last 12 months and only five releases overall. This is meaningful maintenance risk, although the stable 2.0.0 version and narrow package scope partly reduce the concern.

Repo commit activity

The repository recorded no commits and no active maintainers in the last three months, consistent with the release history's long pause. The repository is not archived, but there is no recent activity demonstrating ongoing maintenance.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected. For a package that transforms user-facing links into HTML, this is a modest transparency and maintenance gap.

Security policy

The linked repository has no security policy. This does not make the package unsafe by itself, but it provides no documented route for reporting or handling vulnerabilities.

Workflow audit

The single workflow was fully analyzed and had no dangerous triggers or audit findings, but both of its action references are unpinned. The lack of a top-level permissions block is acceptable on its own; unpinned actions remain a supply-chain hygiene concern.