Package Health/onesignal/onesignal-php-api

onesignal/onesignal-php-api

This release appears healthy and suitable for dependency use: it is a stable, non-deprecated version with 23 releases over roughly 20 months, 18 releases in the last 12 months, and a median release interval of about 12 days. The repository is active, organization-backed, correctly associated with the package, not archived, and uses Composer plus CodeQL; recent activity includes 11 commits and 7 merged pull requests in the last 3 months. The main concerns are that the repository's recent commits are entirely attributed to a release bot, the artifact and repository report no tests, no security policy is present, and workflows lack top-level permission declarations. These are meaningful hygiene and resilience gaps, but they do not outweigh the strong release cadence, active repository state, and organization backing.

Latest 5.16.0

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Package scaffolding

The package includes a README and changelog, and the repository uses GitHub Releases, but neither the artifact nor repository reports tests. For an API client, the missing test evidence is a maintenance and regression-risk gap.

Repo bus factor

All 11 recent commits came from one contributor, semantic-release-bot, giving the observed activity a weak human bus factor. Organization backing partly mitigates handoff risk, but the signal still warrants caution because no human contributor activity is shown.

Security policy

No SECURITY.md or equivalent security policy was found, leaving vulnerability-reporting and response expectations less transparent.

Token permissions

All three workflows lack top-level permission declarations, although none declares top-level write permissions and two use job-level permissions. Explicit least-privilege declarations would provide stronger CI security hygiene.