Package Health

dunglas/php-schema

The source project is backed by an organization, has an MIT license, repository tests, and a security policy. Pin api-platform/schema-generator instead, which Packagist identifies as the replacement.

Latest v5.2.5PackagistPackagist

22%

Total Score

Maintainer Stability
Maintainer Stability
Assesses the consistency and reliability of package maintainers

75

Maturity
Maturity
Indicates package age, release frequency, and adoption metrics

75

Supply Chain
Supply Chain
Evaluates supply chain security practices and risks

75

Health Score Breakdown

Registry deprecationdanger

Packagist marks the entire package as abandoned and names api-platform/schema-generator as its replacement. This is a severe adoption risk for a new dependency.

Release historycaution

The package has existed for 4299 days with 34 releases, but only 1 release in the last 12 months, suggesting a sharply reduced release cadence.

Repo commit activitycaution

The repository had 0 commits and 0 active maintainers in the last 3 months, indicating no recent development activity despite the repository remaining available.

Repo package mentioncaution

The linked repository name does not match dunglas/php-schema and its README does not mention the package. This weakens package-to-repository traceability, although the repository appears related to the schema generator project.

Workflow auditcaution

Both workflows were fully analyzed with no reported audit findings or untrusted execution paths, but all 6 action references are unpinned, leaving them exposed to upstream action changes.

Vulnerabilities

We didn't find any vulnerabilities for this package.

Package versions

Maintainers

Kévin Dunglas

Direct Dependencies

DependencyLast ReleaseScore
psr/log
Version ^1.0 || ^2.0 || ^3.0
twig/twig
Version ^3.0
symfony/yaml
Version ^5.4 || ^6.4 || ^7.0 || ^8.0
symfony/config
Version ^5.4 || ^6.4 || ^7.0 || ^8.0
symfony/string
Version ^5.4 || ^6.4 || ^7.0 || ^8.0

Weekly Downloads

Info

Last Published
7 months ago
Created
11 years ago

Are You Affected?

Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.

Free. No credit card required.

Aikido Platform