Its stable version and modest runtime dependency set offer little reassurance against the package’s age and withdrawn status. The source repository could not be found, limiting verification of maintenance and provenance.
15%
Total Score
100
33
The registry marks the entire package as abandoned and names jms/serializer as its replacement, making this release unfit to adopt despite the lack of a deprecation message.
The package was last released in May 2016 and has had no release in over 10 years, which is strong evidence of abandonment for a library dependency.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
jms/metadata Version ~1.1 | — | — |
jms/parser-lib Version 1.* | — | — |
doctrine/annotations Version 1.* | — | — |
doctrine/instantiator Version ~1.0.3 | — | — |
phpcollection/phpcollection Version ~0.1 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.