Clear licensing, release notes, tests, and a matching repository make the package easy to evaluate. Recent release activity is strong, but no commits were recorded in the last three months, and workflow references are not pinned. The missing security policy and automated security scanning add smaller maintenance concerns.
70%
Total Score
50
100
94
75
Only one registry maintainer is listed. Because the repository is also user-owned and the package has a substantial release history, this is a modest bus-factor concern rather than evidence of abandonment.
The package and repository are owned by the same individual account, so there is no organization backing to offset the single-publisher structure. The active release history provides some compensation, making this a mild concern rather than a severe risk.
The repository recorded zero commits and zero active maintainers in the last three months. This is a real maintenance warning, although the recent release and longer release history partly offset it.
Issue and pull-request activity is limited, with one new issue and one new pull request in the last month and no closures or merges. This suggests modest current activity, but it is less concerning than a fully inactive repository.
Composer build tooling is present, but no security-scanning tools were detected. For a dependency intended for production applications, that leaves a repository hygiene gap.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
psr/log Version ^2.0 || ^3.0 | — | — |
symfony/yaml Version ^5.4 || ^6.0 || ^7.0 || ^8.0 | — | — |
spiral/goridge Version ^4.0 | — | — |
symfony/config Version ^5.4 || ^6.0 || ^7.0 || ^8.0 | — | — |
spiral/roadrunner Version ^2023.1.0 || ^2024.1.0 || ^2025.1.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.