Clear licensing, release notes, and repository tests make the package easy to evaluate. Its small solo maintainer base and unpinned CI actions leave less margin for long-term upkeep.
68%
Total Score
50
83
75
One registry maintainer is consistent with a small user-owned project, but it provides limited redundancy if that maintainer becomes unavailable.
The package has existed for over five years with 19 releases, but only one release in the last 12 months, indicating a slower current cadence.
The repository recorded no commits and no active maintainers in the last three months. The March 2026 release shows recent activity existed, but the current pause still raises upkeep risk.
Composer build tooling is present, but no security scanning tools were detected. This is a modest transparency and maintenance gap rather than a severe risk.
Both workflows were analyzed successfully and have no detected dangerous findings, but all four referenced actions are unpinned, leaving CI exposed to upstream action changes.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
symfony/serializer Version ^5.2|^6.0|^7.0 | — | — |
illuminate/contracts Version ^10.0|^11.0|^12.0|^13.0 | — | — |
symfony/property-info Version ^5.2|^6.0|^7.0 | — | — |
symfony/property-access Version ^5.2|^6.0|^7.0 | — | — |
morrislaptop/symfony-custom-normalizers Version ^0.4|^0.5 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.