devscast/flexpay

The project has recent releases, tests, documentation, a security policy, and active repository tooling. Do not adopt this release until the package deprecation is resolved; workflow pinning and single-contributor maintenance add further risk.

Latest 3.0.1

Packagist

20%

Total Score

Maintainer Stability

Maturity

Supply Chain

Using this package? Scan for Free

Health Score Breakdown

Registry deprecation

Packagist marks the package deprecated at package scope and provides no distinct replacement, making the release unsuitable to adopt until that status is clarified.

Repo bus factor

One contributor made all 2 recent commits, leaving maintenance dependent on a single active contributor even though the repository owner is an organization.

Repo commit activity

There were 2 commits in the last 3 months, so maintenance is present but limited in volume.

Workflow audit

All four workflows use read-only permissions and the audit completed fully, but all 11 action references are unpinned. The only reported cache-poisoning finding has low confidence, so it is a hygiene concern rather than a severe finding.

Vulnerabilities

We didn't find any vulnerabilities for this package.

Package versions

Maintainers

bernard-ng

Direct Dependencies

Dependency	Last Release	Score
webmozart/assert Version ^1.11\|^2.4	—	—
symfony/serializer Version ^7.0\|^8.0	—	—
symfony/http-client Version ^7.0\|^8.0	—	—
symfony/property-access Version ^7.0\|^8.0	—	—