shoptet/api-sdk-php

This release appears healthy and suitable for dependency use: it is actively maintained, with 26 releases in the last 12 months, a median release interval of about 7 days, 68 commits and 12 active maintainers in the last 3 months, and 16 merged pull requests in the last month. The package is not deprecated or archived, is backed by the Shoptet organization, includes a clear MIT license, README, tests, changelog, substantial source tree, and no install-time lifecycle scripts. The main reservations are missing repository security policy and undeclared workflow token permissions, plus no reported security-scanning tooling; these are transparency and CI-hygiene gaps rather than evidence of abandonment. Its 0.4 version indicates pre-1.0 API stability risk, but recent releases are not prereleases and the maintenance activity is strong.

Latest v0.4.17

Packagist

92%

Total Score

Maintainer Stability

100

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo popularity

The repository has only 3 stars and 4 forks, so external adoption evidence is limited; this is a supporting weakness, not a health verdict, given the strong maintenance signals.

Repo tooling

Composer build tooling is present, but no security-scanning tools were detected; this is a modest CI transparency gap rather than a maintenance failure.

Security policy

No repository security policy was found, leaving vulnerability reporting and response expectations undocumented.

Token permissions

The repository's only workflow lacks top-level token-permission declarations. No write permissions were observed, but explicit least-privilege configuration would improve CI hygiene.

Version stability

The current v0.4.17 release is not a prerelease and recent releases have no prerelease share, although the pre-1.0 major version leaves some API compatibility risk.