susina/xml-to-array

This is a usable, transparently maintained small PHP library with a stable v2.1 release, six releases over roughly two years, a matching repository, comprehensive tests, an explicit Apache-2.0 license, and no deprecation or dangerous workflow findings. However, commit activity shows no commits and no active maintainers in the last 3 months, while the repository has only 1 star and 1 fork; the lack of a security policy and explicit workflow token permissions also reduces operational maturity. The recent repository push and three merged pull requests provide some compensating evidence, so this is suitable to depend on with normal maintenance monitoring rather than an abandonment-free recommendation.

Latest v2.1

Packagist

72%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo commit activity

There were 0 commits and 0 active maintainers in the last 3 months, which is a meaningful maintenance-slowdown and abandonment risk. The recent repository push and three merged pull requests partly compensate but do not erase the inactivity signal.

Repo popularity

The repository has only 1 star, 1 fork, and 1 watcher, indicating limited adoption and community visibility; this is a caution rather than a verdict for a small stable library.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected; the missing scanning is a modest operational hygiene gap for a dependency.

Security policy

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented; this lowers transparency and security maturity.

Token permissions

Both workflows lack top-level token permission declarations. Although no workflow requests top-level write access, explicit least-privilege permissions would provide stronger CI hardening.