xeroapi/xero-php-oauth2

This is a mature, actively published PHP SDK with 128 releases since 2019, 13 releases in the last 12 months, a stable non-prerelease version, a current repository, clear MIT licensing, substantial documentation, and an organization-owned source repository that matches the package. The main concerns are that recent repository activity is low and concentrated in one contributor, the repository has no tests or changelog, security scanning and a security policy are absent, and workflow token permissions are not explicitly constrained; these reduce transparency and operational resilience but do not outweigh the strong release history, current publication, project backing, and repository hygiene.

Latest 16.2.0

Packagist

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Package scaffolding

The package has extensive README documentation and the repository uses GitHub Releases, which partly compensates for the absence of packaged tests and a changelog. However, the repository also reports no tests, leaving a genuine verification gap for a large SDK.

Repo bus factor

All three recent commits came from one contributor, with a 100% commit share. Organization backing provides some handoff capacity, but the observed short-term concentration still reduces resilience.

Repo commit activity

Only three commits occurred in the last three months, indicating low recent development activity despite the recent release history.

Repo issue activity

Two pull requests were merged in the last month, showing some ongoing maintenance, but there were no newly opened or closed issues and no newly opened pull requests during that period.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected. The build setup is appropriate, while security-process visibility remains limited.