Recent commits, release notes, tests, and substantial documentation provide useful support. The broad dependency set and absent security policy add modest ongoing-maintenance risk.
65%
Total Score
63
50
79
50
Twenty-one runtime dependencies create a relatively broad maintenance and transitive-change surface for a framework, though the package does declare its dependencies explicitly.
Only one registry account has publish access. This is consistent with the user-owned project but leaves little publishing redundancy.
The repository is owned by an individual rather than an organization, so the single-contributor maintenance concentration has no demonstrated organizational handoff cushion.
The project is about three years old with 15 releases and a latest release in December 2025, but only one release occurred in the last 12 months, indicating slower recent cadence.
All 23 recent commits came from one contributor, leaving maintenance highly concentrated and dependent on a single person.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
nyholm/psr7 Version ^1.5 | — | — |
catfan/medoo Version ^2.1 | — | — |
mezon/router Version ^1.5 | — | — |
symfony/yaml Version ^6.1 | — | — |
league/climate Version ^3.8 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.