facturapi/facturapi-php

Facturapi PHP 4.8.1 appears to be a healthy dependency: it has a long release history dating from 2018, 14 releases in the last 12 months, a stable non-prerelease version, active repository maintenance, tests, changelog, a clear MIT license, and no install-time lifecycle scripts. The linked organization-owned repository matches the package and has recent activity from two contributors, which supports continuity despite modest popularity. The main reservations are the absence of security scanning and a security policy, plus a workflow with top-level write permissions; these warrant review of the CI/CD configuration but do not outweigh the strong maintenance and packaging evidence.

Latest 4.8.1

Packagist

88%

Total Score

Maintainer Stability

100

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo tooling

Composer build tooling is present, but no security scanning tools were detected; the missing scanning reduces security-process transparency, though it is not by itself evidence of unhealthy maintenance.

Security policy

The repository has no SECURITY.md or equivalent security policy, leaving vulnerability-reporting and response expectations undocumented.

Token permissions

Workflow permissions are explicitly declared, but one deployment workflow has top-level write permissions. This is a contained CI/CD privilege concern that merits review, despite the absence of other dangerous workflow patterns.