buckaroo/sdk

This release appears healthy and suitable to depend on: it has a stable, active release history, is not deprecated, is backed by an organization-owned repository that was pushed recently, and shows ongoing multi-contributor development. The package is well-scaffolded with documentation, tests, a changelog, examples, and a license, while its install lifecycle is inactive and its dependency profile is moderate. The main reservations are the absence of repository security scanning and a security policy, plus workflows that do not declare top-level token permissions; these are transparency and hardening gaps rather than evidence of abandonment.

Latest 1.24.4Packagist

Health Score Breakdown

Repo toolingcaution

Composer is used as a build tool, but no security scanning tools were detected. The missing scanning is a modest hardening and transparency gap, not a maintenance failure.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting and response expectations undocumented.

Token permissionscaution

Both analyzed workflows lack top-level token permission declarations. Although no write permissions or dangerous workflow patterns were detected, explicit least-privilege declarations would improve CI security hygiene.

View all 20 health checks

Vulnerabilities

We didn't find any vulnerabilities for this package.

Maintainers

Buckaroo

Direct Dependencies

Dependency	Last Release	Score
ramsey/uuid Version ^3.9.7|^4	—	—
monolog/monolog Version ^2.2|^3	—	—
guzzlehttp/guzzle Version ^7.0	—	—
composer/ca-bundle Version ^1.3	—	—