upstox/upstox-php-sdk

This release appears healthy and suitable for dependency use: it is a stable, non-deprecated package with a strong release cadence, an active non-archived organization-backed repository, multiple recent contributors, tests, documentation, and clear MIT licensing. The main reservations are operational rather than abandonment concerns: the repository lacks a published security policy, its workflow grants top-level write permissions, and no security-scanning tooling was detected. Low repository popularity and the absence of a changelog modestly reduce transparency but are outweighed by recent releases, GitHub Releases, repository tests, and ongoing commit activity.

Latest v1.30.0Packagist

Health Score Breakdown

Repo popularitycaution

The repository has only 5 stars, 4 forks, and 3 watchers, which limits external validation and community visibility, though popularity is supporting evidence rather than a health verdict.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools were detected. This leaves a moderate process gap, although the package still has structured build support.

Security policycaution

No repository security policy was found, reducing transparency for vulnerability reporting and coordinated disclosure.

Token permissionscaution

The analyzed workflow declares top-level write permissions, which grants broader CI token authority than a read-only default and increases workflow-impact risk if compromised.

View all 19 health checks

Vulnerabilities

We didn't find any vulnerabilities for this package.

Direct Dependencies

Dependency	Last Release	Score
amphp/amp Version ^3.0	—	—
ramsey/uuid Version ^4.7	—	—
google/protobuf Version ^3.25	—	—
guzzlehttp/psr7 Version ^1.7 || ^2.0	—	—
guzzlehttp/guzzle Version ^7.3	—	—

View All 6 Dependencies