psr/http-message

Usable with caveats: this is a mature, stable interface package with clear licensing, minimal dependencies, strong project backing, and a matching source repository. However, it has had no registry releases or repository commits for about three years, so future maintenance should not be assumed.

Latest 2.0

Packagist

72%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has 19 releases since 2014, but its latest release was about three years ago and it had no releases in the last 12 months. That is a meaningful maintenance concern, although a stable interface package may need fewer changes.

Repo commit activity

There were no commits and no active maintainers in the last three months, consistent with the roughly three-year gap since the last release. This is the main ongoing-maintenance risk, partly offset by the package's mature and intentionally small interface scope.

Repo tooling

The repository uses Composer for its build process, which fits the package ecosystem, but no security scanning tools were detected. For this small interface-only package, that is a limited hygiene gap rather than a severe risk.

Security policy

The repository has no security policy. This reduces transparency for reporting vulnerabilities, although the package contains a small set of interfaces rather than an implementation with substantial runtime attack surface.