saloonphp/saloon

A permissive license, release notes, repository tests, and a security policy support straightforward adoption. Pin the referenced GitHub Actions before relying on the project’s automation.

Latest v4.3.0

Packagist

84%

Total Score

Maintainer Stability

100

Dependencies

100

Maturity

100

Supply Chain

100

Are you affected? Scan for Free

Health Score Breakdown

Workflow audit

All 3 workflows were analyzed successfully with no auditor findings or untrusted checkout and script-injection issues. However, all 8 referenced actions are unpinned and one workflow grants top-level write permissions, creating a moderate automation-hygiene concern.

Vulnerabilities

Title	Versions	Severity
CVE-2026-33942 saloonphp/saloon is vulnerable to Deserialization of Untrusted Data in versions 0.0.0 - 4.0.0.	0.0.0 - 4.0.0	High
CVE-2026-33183 saloonphp/saloon is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 4.0.0.	0.0.0 - 4.0.0	Medium
CVE-2026-33182 saloonphp/saloon is vulnerable to Insufficiently Protected Credentials in versions 0.0.0 - 4.0.0.	0.0.0 - 4.0.0	Medium

Package versions

Maintainers

Sam Carré

Direct Dependencies

Dependency	Last Release	Score
guzzlehttp/psr7 Version ^2.0 \|\| ^3.0	—	—
psr/http-factory Version ^1.0	—	—
psr/http-message Version ^1.1 \|\| ^2.0	—	—
guzzlehttp/guzzle Version ^7.6 \|\| ^8.0	—	—
guzzlehttp/promises Version ^1.5 \|\| ^2.0 \|\| ^3.0	—	—