The package is clearly documented, tested, licensed, and backed by an organization. Its release activity has stopped since February 2024, and the workflow uses two unpinned actions, so future compatibility and build reproducibility need care.
65%
Total Score
100
100
81
67
The latest release was on February 1, 2024, with no releases in the following 12 months despite a package age of 1040 days; this is a meaningful maintenance concern, though the package has nine releases and is not deprecated.
The repository has three stars and one fork, indicating limited adoption evidence; popularity is only supporting context and does not outweigh the clear documentation and tests.
Composer build tooling is present, but no security-scanning tools are reported, leaving a modest repository hygiene gap.
The repository has no security policy, which makes vulnerability reporting less transparent; this is a secondary concern because the package is small and otherwise well documented.
The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, both action references are unpinned, which weakens build reproducibility.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
symfony/validator Version ^6.3 | — | — |
spatie/array-to-xml Version ^3.2 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.