substancephp/http

The repository is active, licensed, tested, and backed by an organization. Its single active contributor, absent security policy, and unpinned workflow actions leave maintenance and build-transparency concerns.

Latest v0.12.2

Packagist

62%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Package scaffolding

The package includes tests, a changelog, a README, and a GitHub release, which support transparency. However, the README says the library is not ready for general use, has regular breaking changes, and still contains several TODOs.

Repo bus factor

One contributor made all 33 commits in the last three months, giving the project a very low practical bus factor. The organization-owned repository provides some handoff capacity, but no second active contributor is shown.

Repo tooling

Composer build tooling is present, but no security-scanning tooling was detected. This is a modest transparency gap rather than evidence of abandonment.

Security policy

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented for a web-facing library.

Version stability

Version v0.12.2 is not a prerelease, but the project remains below 1.0 and explicitly warns of breaking changes from version to version. That limits compatibility confidence for dependents.

Vulnerabilities

We didn't find any vulnerabilities for this package.

Package versions

Maintainers

Matthew Harvey

Direct Dependencies

Dependency	Last Release	Score
psr/log Version ^3.0	—	—
psr/container Version ^2.0	—	—
nikic/php-parser Version ^5.0	—	—
psr/http-factory Version ^1.1	—	—
substancephp/container Version ^0.6.2	—	—