phlib/xss-sanitizer

Release activity has stopped for over two years, with no commits in the past three months. The repository is identifiable, tested, licensed, and not archived, but it lacks a security policy and uses four unpinned workflow actions.

Latest 2.1.0

Packagist

62%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has made seven releases since 2016, but none in the last two years and three months. This weakens confidence in ongoing maintenance for a security-focused library.

Repo commit activity

There were no commits and no active maintainers in the past three months. This is a meaningful maintenance warning, although the repository was pushed more recently than the latest package release.

Repo tooling

The project uses Composer, but no security scanning tools were detected. For an HTML sanitization library, that is a modest transparency and maintenance gap.

Security policy

The repository has no security policy. That makes vulnerability reporting and response expectations less clear for a security-sensitive package.

Workflow audit

The single workflow was fully analyzed with no dangerous triggers, sinks, or audit findings, but all four action references are unpinned. The workflow also lacks a top-level permissions block, which is acceptable on its own.