milpa/http-symfony

This is a small but well-structured and actively published package with strong repository hygiene: it is not deprecated or archived, has six releases over 42 days, includes tests, a changelog, licensing files, security policy, and CI/release tooling, and its repository clearly matches the package. The main reservations are that it is a young pre-1.0 project, has no observed community popularity, lacks security-scanning tooling, and uses top-level write permissions in three workflows. These concerns warrant some caution for a production dependency, but the available evidence otherwise supports a healthy, maintained release.

Latest v0.2.3

Packagist

78%

Total Score

Maintainer Stability

100

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo popularity

The repository has zero stars, forks, and watchers, so there is no community adoption evidence to support maturity. This is a caution rather than a severe risk because the package is only 42 days old and other maintenance signals are positive.

Repo tooling

Composer build tooling is present, but no security-scanning tool was detected. The missing scanner is a transparency and process gap, though it is partly offset by the repository's other validation and workflow files.

Token permissions

All workflows declare top-level permissions, and one is read-only, but three workflows request top-level write access. Those writes may be needed for release automation, yet broader-than-minimal permissions increase CI supply-chain exposure.

Version stability

The release is not a prerelease, but v0.2.3 is below a stable major version, so the public API may still change and should be adopted with compatibility expectations appropriate to an early project.