This release appears suitable to depend on: it has a long release history, recent publishing activity, stable versioning, an active non-archived source repository, a clear MIT license, tests, and no install-time lifecycle scripts. Maintenance is not especially broad—the repository made only 4 commits in the last 3 months and 75% came from one of 2 contributors—and the project lacks a security policy and security scanning, while its release workflow grants top-level write permissions. These are meaningful governance and bus-factor cautions, but they are outweighed by continued releases, recent repository activity, stable packaging, and the presence of tests.
82%
Total Score
50
50
94
80
The package declares 12 runtime dependencies, including several PHP extensions and core framework components. This is a meaningful integration surface but not intrinsically unhealthy for a framework library.
Only one registry account has publishing access, which is a modest release-account resilience concern. However, registry access records do not establish actual maintenance capacity, and repository activity shows two active contributors.
The repository is owned by an individual user rather than an organization, so there is no organizational handoff capacity to offset contributor concentration.
Two contributors were active, but the top contributor made 75% of the recent commits. This concentration creates some continuity risk without indicating immediate abandonment.
There were 4 commits in the last 3 months from 2 active maintainers, showing ongoing work but at a relatively modest pace for a core library.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
symfony/process Version ^5.4|^6.0|* | — | — |
topthink/framework Version ^6.0|^8.0|* | — | — |
topthink/think-orm Version ^2.0|^3.0 | — | — |
topthink/think-migration Version ^3.0|* | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.