What Plumb checks

Every score is built from the checks below. Each one measures something observable about a package: its code, its configuration, its metadata, or its activity. Open a check to see exactly what it looks at, how it decides, and how to do well on the practice it measures.

Curious how the checks combine into a score? Read how scoring works.

Security

How likely the package is to become a way in for an attacker, or to expose its users to a known vulnerability.

GitHub Actions pinned to SHA Checks whether third-party GitHub Actions used in the workflows are pinned to a full commit SHA instead of a tag or branch.

weight 8 GitHub only

GitLab CI includes pinned to SHA Checks whether external include: entries in the GitLab CI configuration are pinned to a full commit SHA instead of a branch, tag, or version.

weight 8 GitLab only

Open security advisories Checks whether the newest release of this package has a known, unfixed security vulnerability.

Dependabot PR responsiveness Checks how long the oldest open Dependabot pull requests have been waiting, with a shorter allowance for security fixes.

weight 7 GitHub only

Renovate MR responsiveness Checks how long the oldest open Renovate merge requests have been waiting, with a shorter allowance for security fixes.

weight 7 GitLab only

Dependabot or Renovate configured Checks whether an automated dependency update tool is set up and covers every package ecosystem the repository actually uses.

Dependency update cooldown configured Checks whether the dependency update tool waits a few days after a new release before proposing it.

Provides a security policy Checks whether the repository tells people how to report a security problem privately, usually through a SECURITY.md file.

Maintenance

How likely the package is to be patched and supported over time.

Abandoned or archived Checks whether the maintainer has marked the package abandoned on Packagist or archived its repository.

Commit and release recency Checks when the package last had a commit on its default branch or a stable release.

composer.lock not committed by library Checks that a library does not ship a composer.lock file in its released package.

Dist archive is lean Checks whether the released package archive is free of test suites, CI configuration, editor settings, and other development-only files.

Ecosystem

Whether the package keeps up with the PHP, Laravel, and Symfony releases its users run.

Current Laravel version supported Checks whether a Laravel package can be installed alongside the current stable Laravel release.

Current PHP version supported Checks whether the package can be installed on the current stable PHP release.

Current Symfony version supported Checks whether a Symfony package can be installed alongside the current stable Symfony release.