litesaml/saml

This release appears healthy and suitable to depend on: it is actively and frequently released, uses a stable major version, is not deprecated or archived, and is backed by a matching organization-owned repository with recent activity from three contributors. The package and repository include a README, changelog, tests, license, Composer build configuration, and workflow checks, while the dependency set is modest. The main reservations are the absence of a security policy and dedicated security-scanning tools, plus workflows that do not declare top-level token permissions; these are transparency and hardening gaps rather than evidence of abandonment. Low repository popularity and a single registry publisher are minor concerns, mitigated by the organization backing and observed multi-contributor activity.

Latest 5.0.0

Packagist

88%

Total Score

Maintainer Stability

100

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo popularity

The repository has only 4 stars, 3 forks, and 1 watcher, indicating limited external adoption and review; this is a supporting caution rather than a health verdict because observed maintenance is strong.

Repo tooling

Composer build tooling is present, but no security-scanning tool was detected, leaving a security-process gap that lowers transparency somewhat.

Security policy

No repository security policy was found, which leaves vulnerability-reporting and response expectations undocumented.

Token permissions

Both workflows lack top-level token-permission declarations. Although no write permissions are explicitly requested, least-privilege intent is not clearly documented.