Usable with caveats: it has a current release, extensive tests and documentation, and is not deprecated or archived. However, the repository had no commits or issue activity in the last three months, and its workflows lack explicit token permissions and security scanning.
68%
Total Score
75
50
83
75
Eleven runtime dependencies, including PHP parsing, console, filesystem, and process components, create meaningful dependency surface but are consistent with a feature-rich converter and are not excessive on their own.
The repository recorded zero commits and zero active maintainers in the last three months, a meaningful maintenance concern despite the recent package release.
There were no new or closed issues and no merged pull requests in the last month, with 24 issues still open, which suggests limited recent project interaction.
The repository has 9 stars and 2 forks, showing limited adoption; popularity is only supporting evidence and does not outweigh the stronger maintenance signals.
The project uses Make and Composer, but no security scanning tools were detected, leaving a security-hygiene gap.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
symfony/console Version ^5.3|^6.3|^6.2|^6.1|^7.0 | — | — |
symfony/process Version ^5.3|^6.3|^6.2|^6.1|^7.0 | — | — |
nikic/php-parser Version ^4.16|^5.0 | — | — |
webmozart/assert Version ^1.10 | — | — |
jfcherng/php-diff Version ^6.10 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.