This is a healthy, established release with a strong maintenance history: it has existed for over six years, has 74 releases, 8 releases in the last 12 months, a roughly 17-day median release interval, and a current stable version. The package is licensed, includes tests and a substantial source/test tree, is not deprecated or archived, and is backed by an organization-owned repository that matches the package. Recent repository activity is sparse and concentrated in one contributor, while the repository lacks security scanning, a security policy, and explicit workflow token permissions; these are meaningful hygiene concerns, but they do not outweigh the package's active release cadence, organizational backing, build/test setup, and direct repository alignment.
82%
Total Score
80
100
89
80
Only one commit from one active maintainer was recorded in the last 3 months, suggesting low recent development activity despite the much stronger release history.
There is only one open issue and no issue or pull-request activity in the last month, which provides little evidence of active community engagement, though it does not indicate abandonment by itself.
The repository has zero stars and forks and only one watcher, indicating limited external adoption; this is supporting evidence only and is outweighed by the package's release cadence and organizational backing.
Composer build tooling is present, but no security-scanning tools were detected, leaving a repository security-hygiene gap.
No repository security policy was found, reducing transparency around vulnerability reporting and response procedures.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
guzzlehttp/guzzle Version ^7 | — | — |
kbsali/redmine-api Version ^2.7 | — | — |
acdh-oeaw/arche-lib Version ^7.6 | — | — |
zozlak/rdf-constants Version ^1.2.1 | — | — |
acdh-oeaw/uri-normalizer Version ^4 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.