ameax/xml-validator

The package is small and clearly documented, with a minimal runtime dependency, matching MIT license, and release notes. It is not deprecated or archived, but its single registry maintainer and limited adoption leave little evidence of ongoing support.

Latest 1.0.1

Packagist

57%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

Only two releases were published, both on June 15, 2023, with no releases in the last 12 months. The package is old enough to be established, but the lack of subsequent releases is a maintenance concern.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the long release gap. This weakens evidence that issues or dependency changes will receive attention.

Security policy

The repository has no security policy. For a small XML validation library this is a transparency gap, though the repository does use Dependabot for security-related dependency monitoring.

Workflow audit

All 9 analyzed action references are unpinned, three workflows grant top-level write permissions, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, which limits the severity.