doctrine/dbal
Healthy and suitable to depend on. It has a long, consistent release history, active multi-contributor maintenance, strong project backing, and thorough repository and release documentation; the only notable caveat is that workflow token permissions are not explicitly restricted.
95%
Total Score
100
100
100
90
Health Score Breakdown
All 16 workflows lack top-level token permission declarations, which is a workflow-hardening gap; however, none declares top-level write permissions, so this is a limited transparency concern rather than a severe risk.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2025-10878 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. doctrine/dbal is vulnerable to Insertion of Sensitive Information into Log File in versions 3.10.2 - 3.10.3 and 4.3.3 - 4.3.4. | 3.10.2 - 3.10.34.3.3 - 4.3.4 | Medium |
CVE-2021-43608 doctrine/dbal is vulnerable to Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in versions 3.0.0 - 3.1.4. | 3.0.0 - 3.1.4 | Critical |
Package versions
Maintainers
 Guilherme Blanco |
| Roman Borschel |
| Benjamin Eberlei |
| Jonathan Wage |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 psr/log Version ^1|^2|^3 | — | — |
psr/cache Version ^1|^2|^3 | — | — |
doctrine/deprecations Version ^1.1.5 | — | — |
Weekly Downloads
Info
- Last Published
- 2 months ago
- Created
- 14 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.