league/commonmark

league/commonmark 2.10.1 appears to be a healthy, mature dependency: it has more than 12 years of release history, 145 releases, nine releases in the last 12 months, a stable non-prerelease version, an active non-archived organization-backed repository, substantial recent commit and pull-request activity, and a matching repository with comprehensive documentation and tests. The main residual concerns are that repository security-scanning tools were not detected and one workflow lacks top-level token permissions, while the registry maintainer count is only one; these are mitigated by the organization ownership, active multi-contributor development, repository security policy, and otherwise restrictive workflow configuration.

Latest 2.10.1Packagist

Health Score Breakdown

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools were detected; this is a transparency and defense-in-depth gap rather than evidence of abandonment.

Token permissionscaution

Two workflows declare read-only permissions and none declare top-level write permissions; one workflow lacks top-level permissions, leaving a modest configuration gap.

View all 20 health checks

Maintainers

Colin O'Dell

Direct Dependencies

Dependency	Last Release	Score
league/config Version ^1.1.1	—	—
psr/event-dispatcher Version ^1.0	—	—
symfony/polyfill-php80 Version ^1.16	—	—
symfony/deprecation-contracts Version ^2.1 || ^3.0	—	—