litesaml/lightsaml

LightSAML 6.0.0 appears to be a healthy dependency: it has a long release history dating back about 11 years, seven releases in the last 12 months, a stable non-prerelease major version, and no registry deprecation. The linked organization-owned repository is active and directly matches the package, with 25 commits from three contributors in the last three months, current publication activity, tests, changelog, CI workflows, and a substantial source tree. The main reservations are concentrated commit activity, no repository security policy or automated security scanning, and workflows without explicit top-level token permissions; these are meaningful hygiene gaps but do not outweigh the strong maintenance and transparency evidence.

Latest 6.0.0Packagist

Health Score Breakdown

Repo bus factorcaution

Three contributors are active, but the top contributor authored 88% of recent commits, creating concentration risk. The organization-owned project and continued activity from two other contributors partly mitigate, but do not eliminate, this concern.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. This is a security-process hygiene gap rather than evidence of poor maintenance by itself.

Security policycaution

The repository has no security policy, reducing transparency about vulnerability reporting and response procedures.

Token permissionscaution

Both workflows lack top-level token permission declarations, although neither requests top-level write permissions. Explicit least-privilege declarations would improve CI security hygiene.

View all 20 health checks

Maintainers

William

Direct Dependencies

Dependency	Last Release	Score
psr/log Version ^3.0	—	—
litesaml/schemas Version ^3.0	—	—
psr/http-factory Version ^1.0	—	—
psr/http-message Version ^2.0	—	—
phpseclib/phpseclib Version ^3.0	—	—

View All 7 Dependencies