Is icanhazstring/composer-unused safe to use?

icanhazstring/composer-unused has no known vulnerabilities on the latest version (0.9.6). DepScope rates its health at 54/100 (high risk).

What is the latest version of icanhazstring/composer-unused?

The latest version of icanhazstring/composer-unused is 0.9.6, released 2026-01-30.

Does icanhazstring/composer-unused have known vulnerabilities?

No known vulnerabilities on the latest version of icanhazstring/composer-unused.

Is icanhazstring/composer-unused deprecated?

No, icanhazstring/composer-unused is actively maintained. Latest release: 0.9.6 (2026-01-30).

What are alternatives to icanhazstring/composer-unused?

DepScope has no curated alternatives for icanhazstring/composer-unused at this time.

What license does icanhazstring/composer-unused use?

icanhazstring/composer-unused is licensed under MIT.

icanhazstring/composer-unused

composerv0.9.6

Show unused packages by scanning your code

License MITpermissive49 versions1 maintainers18 deps

composer-unused/composer-unused

54

/ 100

Health

safe to use

icanhazstring/[email protected] is safe to use (health: 54/100)

Health breakdown0 – 100

15/25

maintenance

0/20

popularity

25/25

security

12/15

maturity

2/15

community

Vulnerabilities

0

none known

Maintainer trust

Active maintainers (3m)

4

Contributors (12m)

7

Primary author dominance

52%

GitHub stars

1,678

Health History

Dependency Tree

License Audit

Dependencies (18)

php ext-json composer-runtime-api composer-unused/contracts composer-unused/symbol-parser composer/xdebug-handler nikic/php-parser ondram/ci-detector phpstan/phpdoc-parser psr/container psr/log symfony/config symfony/console symfony/dependency-injection symfony/property-access symfony/serializer webmozart/assert webmozart/glob

API access

Get this data programmatically — free, no authentication.

curl https://depscope.dev/api/check/composer/icanhazstring/composer-unused

Last updated · 2026-01-30T05:52:24+00:00