Package Health

crazy-goat/reactphp-runtime

The package is well documented, tested, licensed, and uses Composer security scanning. Its small footprint and organization backing help, but unpinned workflow actions leave a preventable build-integrity gap.

Latest v0.3.0PackagistPackagist

56%

Total Score

Maintainer Stability
Maintainer Stability
Assesses the consistency and reliability of package maintainers

75

Maturity
Maturity
Indicates package age, release frequency, and adoption metrics

88

Supply Chain
Supply Chain
Evaluates supply chain security practices and risks

67

Health Score Breakdown

Release historycaution

Only three releases were published, all within roughly two days in June 2025, with no release in about 15 months. That strongly limits evidence of ongoing maintenance.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months, consistent with the long release gap and raising abandonment risk.

Repo popularitycaution

The repository has zero stars, forks, and watchers. This is supporting evidence of a very small or immature project, not a severe concern by itself.

Security policycaution

The repository has no security policy, leaving reporting and response expectations unclear. This is a transparency gap, though Composer security scanning partly supports operational hygiene.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers or audit findings, but all four action references are unpinned, leaving builds exposed to mutable action changes.

Vulnerabilities

We didn't find any vulnerabilities for this package.

Package versions

Maintainers

Tobias Nyholm
Piotr Halas

Direct Dependencies

DependencyLast ReleaseScore
react/http
Version ^1.6
—
—
symfony/runtime
Version ^5.4 || ^6.0 || ^7.0
—
—
symfony/http-kernel
Version ^5.4 || ^6.0 || ^7.0
—
—
psr/http-server-handler
Version ^1.0
—
—
symfony/psr-http-message-bridge
Version ^2.1 || ^6.4 || ^7.0
—
—

Weekly Downloads

Info

Last Published
1 year ago
Created
1 year ago

Are You Affected?

Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.

Free. No credit card required.

Aikido Platform