sanmai/mercari-php-sdk

The package includes a substantial README, repository tests, clear licensing, and release notes for this version. Its small audience and independent ownership warrant more care than a widely shared project.

Latest 0.1.30

Packagist

70%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Project backing

The repository is owned by an individual rather than an organization, which provides no broader organizational maintenance capacity to offset the concentrated contributor base.

Repo bus factor

All 29 recent commits came from one contributor, so maintenance depends heavily on a single person and has limited handoff resilience.

Security policy

The repository has no security policy, leaving reporting and response expectations undocumented. This is a transparency gap, not evidence that the package is unsafe.

Version stability

Version 0.1.30 is not a stable major release, but it is not prerelease and recent releases have not been prereleases. This is a modest compatibility caveat rather than a maintenance concern.

Workflow audit

All 11 analyzed action references are unpinned, and the audit found a high-confidence template-injection issue; there were no untrusted checkout or script-injection findings, so this is workflow hygiene risk rather than a severe dependency verdict.

Vulnerabilities

We didn't find any vulnerabilities for this package.

Package versions

Maintainers

Alexey Kopytko

Direct Dependencies

Dependency	Last Release	Score
psr/log Version ^1.1 \|\| ^2 \|\| ^3	—	—
jms/serializer Version ^3.29	—	—
sanmai/duoclock Version ^0.1.3	—	—
guzzlehttp/guzzle Version ^6.3 \|\| ^7.0	—	—
doctrine/annotations Version ^2.0	—	—