Its MIT license, bundled tests, and stable version provide useful baseline quality. Adopt the stated replacement, sunrise/http-message, rather than this abandoned package.
12%
Total Score
30
100
The package includes a README and tests, but the README explicitly says it was moved to http-message and is abandoned. The missing changelog is not a concern for a published package.
Packagist marks the entire package as abandoned and names sunrise/http-message as its replacement, making continued dependency adoption unfit.
There have been no releases in roughly 3 years and 9 months, despite 20 releases overall; this supports the package's abandoned status.
This is a stable, non-prerelease major version, which is positive for release maturity but cannot offset the package-wide abandonment.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
sunrise/uri Version ^1.2 | — | — |
sunrise/stream Version ^1.2 | — | — |
psr/http-factory Version ^1.0 | — | — |
psr/http-message Version ^1.0 | — | — |
sunrise/http-message Version ^2.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.