flix-tech/avro-php

The Apache license, focused dependencies, tests, and release notes provide a clear baseline. Organizational ownership and a matching repository add useful transparency for consumers.

Latest 5.2.0

Packagist

67%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has existed for over eight years with 19 releases, but only one release occurred in the last 12 months. This shows continuity with a currently modest cadence.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last three months. The recent release partly compensates for this pause, but the current maintenance capacity remains uncertain.

Repo tooling

The project uses Make and Composer, supporting repeatable builds, but no security scanning tool was detected. This is a modest transparency and maintenance gap.

Security policy

The repository has no security policy. For a library consumed by other projects, this leaves vulnerability reporting and response expectations unclear.

Workflow audit

The single workflow was fully analyzed and has no untrusted checkout or script-injection path, but it has a high-confidence artipacked finding because checkout credentials are not disabled before artifact handling. All nine action references are also unpinned, weakening build reproducibility.