PHPackages                             pierre-arthur/sf-doctor - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Utility &amp; Helpers](/categories/utility)
4. /
5. pierre-arthur/sf-doctor

ActiveSymfony-bundle[Utility &amp; Helpers](/categories/utility)

pierre-arthur/sf-doctor
=======================

Automated audit tool for Symfony projects

v3.2.3(3mo ago)11146↓83.3%MITPHPPHP &gt;=8.2CI passing

Since Mar 23Pushed 4mo agoCompare

[ Source](https://github.com/pierrearthurdemengel/SF-Doctor)[ Packagist](https://packagist.org/packages/pierre-arthur/sf-doctor)[ RSS](/packages/pierre-arthur-sf-doctor/feed)WikiDiscussions main Synced 1w ago

READMEChangelog (3)Dependencies (26)Versions (30)Used By (0)

SF-Doctor
=========

[](#sf-doctor)

**Outil CLI d'audit automatise pour projets Symfony — 80+ checks, 11 modules, zero config.**

SF-Doctor analyse la securite, l'architecture, la performance et la configuration de vos projets Symfony. Il detecte les failles, les anti-patterns et les oublis de configuration. Un rapport clair avec des recommandations concretes, du code de correction, et une estimation du temps de remediation — directement dans votre terminal, en JSON, PDF ou SARIF pour GitHub Code Scanning.

[![CI](https://github.com/sf-doctor/sf-doctor/actions/workflows/ci.yaml/badge.svg)](https://github.com/sf-doctor/sf-doctor/actions/workflows/ci.yaml)[![PHPStan level 8](https://camo.githubusercontent.com/d117944b58da8146f96b4ef7403807610a20eeb3fbcaaaf95157bbcdad1686eb/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048505374616e2d6c6576656c253230382d627269676874677265656e2e737667)](https://phpstan.org/)[![PHP 8.2+](https://camo.githubusercontent.com/0f16581d1180dbfd4c0e13166ec1267d4ad2f2fab8281ea6d6b284cf5c65d921/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048502d382e322532422d626c75652e737667)](https://www.php.net/)[![Symfony 6.4|7.x](https://camo.githubusercontent.com/c786cdaaca91e8091119a6ab20ef404c7fe26ba50aa7c47066c23494c98ce59d/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f53796d666f6e792d362e34253230253743253230372e782d626c61636b2e737667)](https://symfony.com/)[![License: MIT](https://camo.githubusercontent.com/fdf2982b9f5d7489dcf44570e714e3a15fce6253e0cc6b5aa61a075aac2ff71b/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4c6963656e73652d4d49542d79656c6c6f772e737667)](LICENSE)

---

Ce que SF-Doctor detecte
------------------------

[](#ce-que-sf-doctor-detecte)

### Module Security (16 analyzers)

[](#module-security-16-analyzers)

AnalyzerCibleExemples de detection**FirewallAnalyzer**`security.yaml`Firewalls sans authenticator, sans access\_control, mode lazy**AccessControlAnalyzer**`security.yaml`Roles manquants, roles deprecies, catch-all mal place, chemins sensibles non proteges**CsrfAnalyzer**`framework.yaml`, `src/Form/`CSRF desactive globalement ou par FormType**SecretsAnalyzer**`.env`, `.env.prod`APP\_SECRET absent, valeur par defaut, trop court**SensitiveDataAnalyzer**`src/Entity/`, `src/Form/`Champs password/token exposes sans `#[Ignore]`**RememberMeAnalyzer**`security.yaml`Cookie sans `secure`, sans `httponly`, lifetime excessif**SymfonyVersionAnalyzer**`composer.lock`Version avec CVE connu, end-of-life, mineure non a jour**CorsAnalyzer**`nelmio_cors.yaml``allow_origin: ['*']` avec credentials, CORS manquant sur /api**HttpsAnalyzer**`security.yaml`Absence de `requires_channel: https`, cookies non securises, HSTS manquant**HttpMethodOverrideAnalyzer**`framework.yaml`HTTP verb tunneling sans protection CSRF**MassAssignmentAnalyzer**`src/Form/``$form->submit($request->request->all())` sans liste blanche**RateLimiterAnalyzer**`framework.yaml`Route de login sans rate limiter (brute force)**BundleRouteExposureAnalyzer**RoutesRoutes de bundles tiers exposees en production**ExposedDebugEndpointsAnalyzer**RoutesEndpoints de debug accessibles en prod**PublicSensitiveFilesAnalyzer**`public/`Fichiers sensibles accessibles (.env, .git, etc.)**SequentialIdAnalyzer**`src/Entity/`IDs sequentiels previsibles sur des ressources sensibles### Module Architecture (7 analyzers)

[](#module-architecture-7-analyzers)

AnalyzerCibleExemples de detection**ControllerAnalyzer**`src/Controller/`QueryBuilder/DQL dans les controllers, acces direct EntityManager**ServiceInjectionAnalyzer**`src/`Injection de `ContainerInterface`, appels `$this->container->get()`**HeavyConstructorAnalyzer**`src/Service/`, `src/Repository/`Appels BDD dans les constructeurs, &gt;8 dependances injectees**VoterUsageAnalyzer**`src/Controller/`Checks de roles manuels au lieu de Voters**PublicServiceAnalyzer**`config/services.yaml`Services declares `public: true` inutilement**EventSubscriberAnalyzer**`src/EventSubscriber/`Logique metier lourde dans les subscribers, couplage EntityManager**InterLayerCoherenceAnalyzer**`src/`Incoherences entre couches (controller, service, repository)### Module Configuration (5 analyzers)

[](#module-configuration-5-analyzers)

AnalyzerCibleExemples de detection**DebugModeAnalyzer**`.env.prod`, `.env`APP\_ENV != prod, APP\_DEBUG=true en production**ProfilerAnalyzer**`packages/`Profiler/toolbar actif en production**MailerAnalyzer**`.env`, `mailer.yaml`DSN `null://null` en prod (emails perdus)**HttpHeadersAnalyzer**ConfigX-Frame-Options, X-Content-Type-Options, CSP manquants**ProductionReadinessAnalyzer**`.env.prod`, `php.ini`opcache timestamps, preload absent, composer.lock non commite### Module Performance (1 analyzer)

[](#module-performance-1-analyzer)

AnalyzerCibleExemples de detection**NplusOneAnalyzer**`templates/`Acces a deux niveaux dans les boucles Twig (N+1 potentiel)### Module Doctrine (5 analyzers)

[](#module-doctrine-5-analyzers)

AnalyzerCibleExemples de detection**EagerLoadingAnalyzer**`src/Entity/``fetch: EAGER` sur OneToMany/ManyToMany**MissingIndexAnalyzer**`src/Entity/`, `src/Repository/`Colonnes filtrees sans `#[ORM\Index]`**CascadeRiskAnalyzer**`src/Entity/``cascade: ['all']`, remove sans orphanRemoval**RepositoryPatternAnalyzer**`src/`QueryBuilder hors des repositories**LazyGhostObjectAnalyzer**`doctrine.yaml`lazy\_ghost\_objects sur Doctrine ORM &lt; 3.0### Module Messenger (4 analyzers)

[](#module-messenger-4-analyzers)

AnalyzerCibleExemples de detection**UnhandledMessageAnalyzer**`src/Message/`Messages sans handler (silencieusement ignores)**UnserializableMessageAnalyzer**`src/Message/`Closures ou resources dans les messages**MessengerTransportAnalyzer**`messenger.yaml`Transport sync, transport failed absent, retry manquant**MessengerSigningAnalyzer**`messenger.yaml`Messages non signes (Symfony 7.4+)### Module API Platform (18 analyzers)

[](#module-api-platform-18-analyzers)

AnalyzerCibleExemples de detection**OperationSecurityAnalyzer**`src/Entity/`, `src/ApiResource/`Operations sans `security`, heritage de securite**SerializationGroupAnalyzer**`src/Entity/`, `src/ApiResource/`Ressources sans groupes de serialisation**PaginationAnalyzer**`api_platform.yaml`Pagination desactivee, client\_items\_per\_page sans maximum (DOS)**ValidationAnalyzer**`src/Entity/`, `src/ApiResource/`Ressources sans `#[Assert\*]`, colonnes NOT NULL sans NotBlank**DtoPatternAnalyzer**`src/Entity/`Entites Doctrine exposees sans DTO (input/output)**FilterConfigAnalyzer**`src/Entity/`, `src/ApiResource/`Filtres `partial` sur champs sensibles, OrderFilter sans restriction**DeprecatedAnnotationAnalyzer**`src/Entity/`, `src/ApiResource/`Annotations 2.x (`@ApiResource`, `@ApiSubresource`)**SubresourceSecurityAnalyzer**`src/Entity/`, `src/ApiResource/`Sous-ressources sans security (IDOR), imbrication profonde**OpenApiConfigAnalyzer**`src/Entity/`, `src/ApiResource/`Ressources et operations sans description OpenAPI**NormalizationContextAnalyzer**`src/Entity/`, `src/ApiResource/`normalizationContext sans denormalizationContext, groupes identiques read/write, groupes orphelins**ApiPropertyConfigAnalyzer**`src/Entity/`, `src/ApiResource/`IDs auto-increment exposes (IDOR), identifiants modifiables**GlobalApiPlatformConfigAnalyzer**`api_platform.yaml`show\_webby actif, error\_formats absent, format HTML, mapping.paths**StateProviderProcessorAnalyzer**`src/Entity/`, `src/ApiResource/`processor/provider referancant une classe inexistante (500 runtime), processor sur ressource read-only**HttpCacheAnalyzer**`src/Entity/`, `src/ApiResource/`Absence de cache HTTP sur GET, cache public sur ressource protegee (fuite de donnees)**RateLimitingAnalyzer**`src/Entity/`, `src/ApiResource/`Endpoints sensibles (login, register) sans throttling, POST publics sans rate limit**CircularReferenceAnalyzer**`src/Entity/`, `src/ApiResource/`Relations bidirectionnelles sans `#[MaxDepth]`, MaxDepth sans `enable_max_depth`**ResourceNamingAnalyzer**`src/Entity/`, `src/ApiResource/`shortName non kebab-case, verbes dans les noms de ressources, routePrefix avec underscores**DeprecatedConfigKeyAnalyzer**`api_platform.yaml`Cles YAML depreciees (collection, item\_operations, exception\_to\_status), Swagger 2, docs en production### Module Twig (3 analyzers)

[](#module-twig-3-analyzers)

AnalyzerCibleExemples de detection**TwigRawFilterAnalyzer**`templates/`Filtre `|raw` (risque XSS)**TwigSrcdocAnalyzer**`templates/`Attribut `srcdoc` sans echappement**BusinessLogicInTwigAnalyzer**`templates/`Logique metier dans les templates### Module Deployment (4 analyzers)

[](#module-deployment-4-analyzers)

AnalyzerCibleExemples de detection**MigrationStatusAnalyzer**`src/Migrations/`Migrations non executees**RequiredEnvVarsAnalyzer**`.env`Variables d'environnement requises manquantes**AssetsAnalyzer**`public/`Assets non compiles ou obsoletes**LogAnalyzer**`monolog.yaml`Level debug en prod, absence de rotation### Module Migration (3 analyzers)

[](#module-migration-3-analyzers)

AnalyzerCibleExemples de detection**DeprecationUsageAnalyzer**`src/`Usages de code deprecie**BundleDependencyAnalyzer**`composer.json`Bundles abandonnes ou incompatibles**PhpVersionAnalyzer**`composer.json`Version PHP non supportee### Module Tests (3 analyzers)

[](#module-tests-3-analyzers)

AnalyzerCibleExemples de detection**TestCoverageAnalyzer**`tests/`Couverture insuffisante**SecurityTestAnalyzer**`tests/`Tests de securite manquants pour les routes protegees**TestFixtureAnalyzer**`tests/`Fixtures absentes ou mal structurees---

Prerequis
---------

[](#prerequis)

- PHP 8.2 ou superieur
- Un projet Symfony 6.4 ou 7.x

---

Installation
------------

[](#installation)

```
composer require --dev pierre-arthur/sf-doctor
```

---

Utilisation
-----------

[](#utilisation)

### En tant que bundle Symfony (recommande)

[](#en-tant-que-bundle-symfony-recommande)

Si votre projet utilise Symfony Flex, le bundle est enregistre automatiquement.

Sinon, ajoutez-le dans `config/bundles.php` :

```
return [
    // ...
    PierreArthur\SfDoctor\SfDoctorBundle::class => ['dev' => true, 'test' => true],
];
```

### Commandes disponibles

[](#commandes-disponibles)

#### `sf-doctor:audit` — Audit standard

[](#sf-doctoraudit--audit-standard)

```
# Audit complet (tous les modules)
bin/console sf-doctor:audit

# Audit d'un module specifique
bin/console sf-doctor:audit --security
bin/console sf-doctor:audit --architecture
bin/console sf-doctor:audit --doctrine
bin/console sf-doctor:audit --messenger
bin/console sf-doctor:audit --api-platform
bin/console sf-doctor:audit --twig
bin/console sf-doctor:audit --deployment
bin/console sf-doctor:audit --migration
bin/console sf-doctor:audit --tests

# Formats de sortie
bin/console sf-doctor:audit --format=json
bin/console sf-doctor:audit --format=console --brief

# Mode diff (comparer avec une baseline)
bin/console sf-doctor:audit --save-baseline=baseline.json
bin/console sf-doctor:audit --diff=baseline.json

# Surveillance en temps reel
bin/console sf-doctor:audit --watch

# Mode asynchrone via Messenger
bin/console sf-doctor:audit --async
```

#### `sf-doctor:full-audit` — Rapport complet avec dette technique

[](#sf-doctorfull-audit--rapport-complet-avec-dette-technique)

```
# Rapport detaille tous modules + estimation financiere
bin/console sf-doctor:full-audit

# Avec TJM personnalise (defaut : 500 EUR/jour)
bin/console sf-doctor:full-audit --tjm=600

# Export SARIF pour GitHub Code Scanning
bin/console sf-doctor:full-audit --format=sarif
```

#### `sf-doctor:fix` — Corrections interactives

[](#sf-doctorfix--corrections-interactives)

```
# Mode interactif : propose et applique les corrections une par une
bin/console sf-doctor:fix

# Voir les corrections sans les appliquer
bin/console sf-doctor:fix --dry-run

# Appliquer toutes les corrections automatiquement
bin/console sf-doctor:fix --auto
```

#### `sf-doctor:install-hooks` — Hook pre-commit Git

[](#sf-doctorinstall-hooks--hook-pre-commit-git)

```
# Installer le hook (lance SF-Doctor avant chaque commit)
bin/console sf-doctor:install-hooks

# Desinstaller le hook
bin/console sf-doctor:install-hooks --uninstall
```

### En mode standalone (sans bundle)

[](#en-mode-standalone-sans-bundle)

SF-Doctor peut aussi fonctionner en dehors d'un projet Symfony :

```
vendor/bin/sf-doctor /chemin/vers/le/projet/symfony
```

---

Integration CI/CD
-----------------

[](#integration-cicd)

### GitHub Action officielle

[](#github-action-officielle)

```
# .github/workflows/audit.yaml
name: SF-Doctor Audit

on: [push, pull_request]

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: sf-doctor/sf-doctor-action@v1
        with:
          format: sarif
          modules: --all
          fail-on-critical: true
          upload-sarif: true
```

L'action GitHub upload automatiquement le rapport SARIF vers GitHub Code Scanning, ce qui affiche les issues directement dans l'onglet "Security" du repository.

Inputs disponibles :

InputDefaultDescription`format``sarif`Format de sortie (`console`, `json`, `sarif`)`modules``--all`Modules a auditer`fail-on-critical``true`Echoue si des issues CRITICAL`upload-sarif``true`Upload vers GitHub Code Scanning`php-version``8.3`Version PHP`baseline`Chemin baseline pour mode diff### Integration manuelle

[](#integration-manuelle)

```
# .github/workflows/ci.yaml
- name: Audit Symfony
  run: |
    OUTPUT=$(bin/console sf-doctor:audit --format=json)
    STATUS=$(echo $OUTPUT | jq -r '.summary.status')
    if [ "$STATUS" = "critical" ]; then exit 1; fi
```

---

Exemple de sortie console
-------------------------

[](#exemple-de-sortie-console)

```
 SF-Doctor - Rapport d'audit
 ============================

 Projet : /var/www/mon-projet
 Issues trouvees : 3

 Module Security
 ----------------

 ---------- ------------------- --------------------------------------------- ---------------------------
  Severite   Analyzer            Message                                        Fichier
 ---------- ------------------- --------------------------------------------- ---------------------------
  CRITICAL   FirewallAnalyzer    No authenticator configured on firewall main   config/packages/security.yaml
  WARNING    CsrfAnalyzer        CSRF disabled on CheckoutType                  src/Form/CheckoutType.php
 ---------- ------------------- --------------------------------------------- ---------------------------

  > Impact metier : Un attaquant peut soumettre des formulaires au nom d'un utilisateur
  > Correction :    Retirer 'csrf_protection' => false du FormType
  > Documentation : https://symfony.com/doc/current/security/csrf.html
  > Temps estime :  15 min

 Module Configuration
 ---------------------

 ---------- -------------------- ----------------------- -----------
  Severite   Analyzer             Message                 Fichier
 ---------- -------------------- ----------------------- -----------
  CRITICAL   DebugModeAnalyzer    APP_DEBUG is true       .env.prod
 ---------- -------------------- ----------------------- -----------

 Score : 70/100
 Temps total de remediation estime : 2h30

```

Exemple de sortie JSON
----------------------

[](#exemple-de-sortie-json)

```
bin/console sf-doctor:audit --format=json
```

```
{
    "meta": {
        "generated_at": "2026-03-25T10:30:00+00:00",
        "project_path": "/var/www/mon-projet"
    },
    "summary": {
        "score": 70,
        "status": "critical",
        "issues_count": {
            "total": 3,
            "critical": 2,
            "warning": 1,
            "suggestion": 0
        }
    },
    "issues": [
        {
            "severity": "critical",
            "module": "security",
            "analyzer": "FirewallAnalyzer",
            "message": "No authenticator configured on firewall main",
            "detail": "...",
            "suggestion": "Add form_login or custom_authenticator",
            "file": "config/packages/security.yaml",
            "line": null,
            "fix_code": "firewalls:\n    main:\n        form_login:\n            login_path: /login",
            "doc_url": "https://symfony.com/doc/current/security.html",
            "business_impact": "Un attaquant peut acceder aux pages protegees",
            "estimated_fix_minutes": 15
        }
    ]
}
```

---

Features
--------

[](#features)

### Auto-detection du contexte

[](#auto-detection-du-contexte)

SF-Doctor detecte automatiquement les composants installes (Doctrine, Messenger, API Platform, Twig, etc.) via `composer.json` et `composer.lock`. Seuls les analyzers pertinents sont executes — zero configuration necessaire.

### Score multi-dimensions

[](#score-multi-dimensions)

Le `ScoreEngine` calcule un score par dimension (securite, architecture, performance, doctrine, messenger, etc.) avec des poids differencies. Chaque issue deduit des points selon sa severite :

SeveritePenaliteCRITICAL-10 pointsWARNING-3 pointsSUGGESTION-1 point### Dette technique

[](#dette-technique)

Le `TechnicalDebtCalculator` estime le temps de remediation en heures et le cout financier selon un TJM configurable. Utilisable via `sf-doctor:full-audit --tjm=600`.

### Mode diff et baseline

[](#mode-diff-et-baseline)

Sauvegardez une baseline et comparez les analyses suivantes pour ne voir que les regressions :

```
bin/console sf-doctor:audit --save-baseline=baseline.json
# ... apres des modifications ...
bin/console sf-doctor:audit --diff=baseline.json
```

### Mode watch

[](#mode-watch)

Surveillez vos fichiers en temps reel pendant le developpement :

```
bin/console sf-doctor:audit --watch
```

SF-Doctor surveille `src/`, `config/` et `templates/`, et relance l'audit a chaque modification.

### Cache

[](#cache)

Les resultats sont mis en cache par hash SHA256 des fichiers de configuration. Si rien n'a change, l'audit est instantane.

### Events

[](#events)

SF-Doctor dispatche des events Symfony a chaque etape de l'analyse :

- `AnalysisStartedEvent`
- `IssueFoundEvent`
- `ModuleCompletedEvent`
- `AnalysisCompletedEvent`

### Workflow

[](#workflow)

Le cycle de vie de l'analyse suit une state machine Symfony : `pending` → `running` → `completed` / `failed`

---

Architecture
------------

[](#architecture)

SF-Doctor est concu comme un bundle Symfony extensible. Chaque verification est un **Analyzer** independant qui implemente `AnalyzerInterface`.

```
src/
├── Analyzer/
│   ├── AnalyzerInterface.php
│   ├── Security/               # 16 analyzers
│   ├── Architecture/           # 7 analyzers
│   ├── Configuration/          # 5 analyzers
│   ├── Performance/            # 1 analyzer
│   ├── Doctrine/               # 5 analyzers
│   ├── Messenger/              # 4 analyzers
│   ├── ApiPlatform/            # 18 analyzers
│   ├── Twig/                   # 3 analyzers
│   ├── Deployment/             # 4 analyzers
│   ├── Migration/              # 3 analyzers
│   └── Tests/                  # 3 analyzers
├── Cache/                      # ResultCache par hash SHA256
├── Command/                    # audit, fix, full-audit, install-hooks
├── Config/                     # YamlConfigReader, ParameterResolver
├── Context/                    # ProjectContext, auto-detection
├── DependencyInjection/        # Extension, CompilerPass, Configuration (TreeBuilder)
├── Diff/                       # AuditReportDiff, BaselineStorage
├── Event/                      # 4 events custom
├── EventSubscriber/            # ProgressSubscriber, CacheSubscriber
├── Git/                        # PreCommitHook
├── Message/                    # RunAnalyzerMessage (mode --async)
├── Model/                      # Issue, AuditReport, Severity, Module
├── Report/                     # Console, JSON, PDF, SARIF
├── Score/                      # ScoreEngine, TechnicalDebtCalculator
├── Serializer/                 # IssueNormalizer, AuditReportNormalizer
├── Watch/                      # FileWatcher (mode --watch)
└── Workflow/                   # AuditContext, AuditWorkflow (state machine)

```

### Creer un analyzer custom

[](#creer-un-analyzer-custom)

Implementez `AnalyzerInterface` et le tag `sf_doctor.analyzer` est ajoute automatiquement via autoconfigure :

```
use PierreArthur\SfDoctor\Analyzer\AnalyzerInterface;
use PierreArthur\SfDoctor\Config\ConfigReaderInterface;
use PierreArthur\SfDoctor\Context\ProjectContext;
use PierreArthur\SfDoctor\Model\AuditReport;
use PierreArthur\SfDoctor\Model\Module;

class MonAnalyzer implements AnalyzerInterface
{
    public function __construct(
        private ConfigReaderInterface $configReader,
    ) {
    }

    public function getName(): string
    {
        return 'Mon Analyzer';
    }

    public function getModule(): Module
    {
        return Module::ARCHITECTURE;
    }

    public function supports(ProjectContext $context): bool
    {
        return true;
    }

    public function analyze(AuditReport $report): void
    {
        // Votre logique d'analyse ici
    }
}
```

Aucune configuration supplementaire necessaire. SF-Doctor detecte et execute automatiquement tous les services qui implementent `AnalyzerInterface`.

### Configuration du bundle

[](#configuration-du-bundle)

SF-Doctor est configurable via `config/packages/sf_doctor.yaml` :

```
sf_doctor:
    score_threshold: 0          # Score minimum (0-100), exit 1 si en dessous
    analyzers:
        security: true
        architecture: true
        performance: true
```

---

Tests
-----

[](#tests)

```
# Lancer tous les tests (890+)
vendor/bin/phpunit

# Analyse statique (level 8)
vendor/bin/phpstan analyse src --level=8
```

---

Licence
-------

[](#licence)

MIT. Voir le fichier [LICENSE](LICENSE).

###  Health Score

44

—

FairBetter than 90% of packages

Maintenance77

Regular maintenance activity

Popularity20

Limited adoption so far

Community6

Small or concentrated contributor base

Maturity58

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~1 days

Recently: every ~9 days

Total

29

Last Release

103d ago

Major Versions

v0.3.0 → v1.0.02026-03-23

v1.9.0 → v2.0.02026-03-25

v2.9.0 → v3.0.02026-03-25

### Community

Maintainers

![](https://www.gravatar.com/avatar/da7085f96c83cbcd2b45374e22b8cb6317083890ab567ed05fece7c0630b2ee9?d=identicon)[pierrearthurdemengel](/maintainers/pierrearthurdemengel)

---

Top Contributors

[![pierrearthurdemengel](https://avatars.githubusercontent.com/u/124669857?v=4)](https://github.com/pierrearthurdemengel "pierrearthurdemengel (27 commits)")

###  Code Quality

TestsPHPUnit

Static AnalysisPHPStan

Type Coverage Yes

### Embed Badge

![Health badge](/badges/pierre-arthur-sf-doctor/health.svg)

```
[![Health](https://phpackages.com/badges/pierre-arthur-sf-doctor/health.svg)](https://phpackages.com/packages/pierre-arthur-sf-doctor)
```

###  Alternatives

[shopware/core

Shopware platform is the core for all Shopware ecommerce products.

595.8M666](/packages/shopware-core)[chameleon-system/chameleon-base

The Chameleon System core.

1029.4k6](/packages/chameleon-system-chameleon-base)[sylius/sylius

E-Commerce platform for PHP, based on Symfony framework.

8.5k6.0M775](/packages/sylius-sylius)[pimcore/pimcore

Content &amp; Product Management Framework (CMS/PIM/E-Commerce)

3.8k3.9M534](/packages/pimcore-pimcore)[shopware/platform

The Shopware e-commerce core

3.4k1.5M3](/packages/shopware-platform)[sulu/sulu

Core framework that implements the functionality of the Sulu content management system

1.3k1.4M231](/packages/sulu-sulu)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)
