karim-tao/dompdf

Healthy and usable for production, with a thin maintenance base as the main caveat. The package has a long release history, recent releases, active commits, clear licensing, tests in the repository, and no deprecation or dangerous workflow findings; most recent commits come from one of two contributors.

Latest v3.1.6.8

Packagist

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Project backing

The registry namespace and repository are owned by a user account rather than an organization. Recent release and commit activity compensate for the lack of organizational backing, but succession capacity is less clear.

Repo bus factor

One contributor made 11 of the 12 recent commits, leaving maintenance heavily concentrated despite a second active contributor. This is a real continuity risk for a user-owned repository.

Repo popularity

The repository reports zero stars, forks, and watchers. Popularity is only supporting evidence, so this lowers external validation but does not outweigh the strong release and maintenance signals.

Repo tooling

The repository uses Composer build tooling but reports no security scanning tools. The missing scanning is a transparency gap, although other workflow and security-policy signals provide some compensation.

Token permissions

The only workflow lacks a top-level permissions declaration. No write permissions were observed, but explicitly limiting token permissions would provide stronger workflow hygiene.