nowo-tech/qr-code-bundle

This release appears suitable to depend on, with strong repository and packaging hygiene: it is MIT-licensed, non-deprecated, actively released, backed by an organization-owned repository, and supported by tests, a changelog, CI, security policy, Dependabot, and recent commit and pull-request activity. The package is relatively young at 35 days old and has a substantial runtime dependency set, while workflow permission declarations are incomplete and one pull-request-target workflow warrants review, so it is healthy overall but not without supply-chain and maturity considerations.

Latest v1.4.8

Packagist

82%

Total Score

Maintainer Stability

100

Dependencies

Maturity

Supply Chain

Health Score Breakdown

Dangerous workflows

One of five workflows uses pull_request_target, which can require careful handling of untrusted pull-request input; however, no untrusted checkout or script-injection pattern was detected.

Dependency profile

The package declares 12 runtime dependencies, including multiple Symfony and Nowo.tech components; this adds dependency-surface and compatibility complexity, though the profile is coherent with a feature-rich Symfony bundle.

Release history

The package has 13 releases in 35 days with a median interval of about 1.3 days, showing active iteration but limited historical maturity.

Token permissions

Four workflows lack top-level permission declarations and one workflow requests top-level write access, leaving avoidable ambiguity in CI token privileges despite job-level permissions being present elsewhere.

Vulnerabilities

We didn't find any vulnerabilities for this package.

Package versions

Maintainers

Héctor Franco Aceituno

Nowo.tech

Direct Dependencies

Dependency	Last Release	Score
twig/twig Version ^3.8 \|\| ^4.0	—	—
symfony/config Version ^7.0 \|\| ^8.0	—	—
endroid/qr-code Version ^6.0	—	—
twig/extra-bundle Version ^3.12	—	—
twig/string-extra Version ^3.12	—	—