Package Health/formancehq/formance-sdk-php

formancehq/formance-sdk-php

This release is actively produced and transparently tied to the matching Formance organization repository: it has 70 releases over roughly 3.7 years, seven releases in the last 12 months, a stable non-prerelease version, a recent repository push, and two active contributors. However, Packagist explicitly marks this package as abandoned and names formance/formance-sdk as its replacement, which is a severe adoption concern even though repository activity remains current. The lack of tests, absent security policy, limited repository popularity, and incomplete workflow permission hardening add caution. Developers should prefer the replacement package unless compatibility requirements specifically require this release.

Latest v7.0.1

Packagist

38%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Registry deprecation

Packagist marks the package as abandoned and identifies formance/formance-sdk as the replacement. This is a severe dependency-health concern because continued use may leave consumers on a superseded package, despite the other evidence of active development.

Package scaffolding

The artifact has a substantial README, but both the package and repository report no tests and no changelog. The repository does contain RELEASES.md and uses GitHub Releases, which partially compensates for changelog absence, but the lack of tests remains a maintenance-hygiene gap.

Repo issue activity

The repository has 3 open issues, with 2 new issues and no closed issues in the last month; one pull request was merged. This suggests some unresolved maintenance demand despite ongoing activity.

Repo popularity

The repository has only 2 stars, 0 forks, and 2 watchers. Popularity is limited and provides little external validation, though low popularity alone is not evidence of abandonment.

Repo tooling

Composer build tooling is present, but no security-scanning tools are reported. Build support is adequate while security-process visibility is limited.

Vulnerabilities

We didn't find any vulnerabilities for this package.

Package versions

Maintainers

No maintainer information available.

Direct Dependencies

Dependency	Last Release	Score
brick/math Version >=0.12.1	—	—
brick/date-time Version >=0.7.0	—	—
galbar/jsonpath Version >=3.0	—	—
guzzlehttp/guzzle Version ^7.0	—	—
speakeasy/serializer Version ^4.0.3	—	—