speakeasy/serializer

The MIT license, readable documentation, source tests, and organization backing provide solid transparency. Unpinned workflow actions and the lack of a security policy leave build and response practices weaker than ideal.

Latest 4.0.3

Packagist

62%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The latest release was about 18 months ago, and there were no releases in the last 12 months. The package has only five releases, indicating a currently inactive release cadence.

Repo commit activity

The repository had zero commits and zero active maintainers in the last 3 months, consistent with the long gap since the latest release. This materially raises maintenance and abandonment risk.

Security policy

The repository provides no security policy, leaving vulnerability-reporting and response expectations unclear. Other project documentation and organization ownership provide some transparency but do not replace a policy.

Workflow audit

All 14 analyzed action references are unpinned, weakening build reproducibility and exposing workflows to changing upstream actions. No untrusted checkouts, injection findings, or broad top-level write permissions were found, so this is a hygiene concern rather than a severe risk.

Vulnerabilities

We didn't find any vulnerabilities for this package.

Package versions

Maintainers

Johannes M. Schmitt

Asmir Mustafic

Ian Bentley

Direct Dependencies

Dependency	Last Release	Score
jms/metadata Version ^2.6	—	—
doctrine/lexer Version ^2.0 \|\| ^3.0	—	—
doctrine/instantiator Version ^1.3.1 \|\| ^2.0	—	—
phpstan/phpdoc-parser Version ^1.4.5 \|\| ^2.1	—	—