pmaglione/lightsaml

It includes tests, documentation, a matching source repository, and a clear MIT license. Maintenance is effectively dormant, with no recent commits or releases, while the repository has no security policy or scanning tools. Pin this only if you can accept owning compatibility and security upkeep.

Latest 1.0.9

Packagist

38%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has had no releases in the last 12 months, and all 9 releases were concentrated around its initial publication nearly 12 years ago. This is strong evidence of abandonment despite the stable 1.0.9 version.

Repo commit activity

The repository recorded 0 commits and 0 active maintainers in the last 3 months, with its last push nearly 12 years ago. The matching repository and release history provide no evidence of current maintenance.

Lifecycle scripts

The package defines post-install and post-update scripts, which add execution during dependency operations. No provided signal shows those scripts are harmful, but they increase the review and upkeep burden for an otherwise dormant package.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected. Given the repository's long inactivity, the missing security checks add to the maintenance concern.

Security policy

The repository has no security policy, leaving vulnerability reporting and response expectations unclear. This is a meaningful transparency gap for a library handling SAML and XML security.