Is macgirvin/http-message-signer safe to use?

macgirvin/http-message-signer has no known vulnerabilities on the latest version (v0.2.13). DepScope rates its health at 52/100 (high risk).

What is the latest version of macgirvin/http-message-signer?

The latest version of macgirvin/http-message-signer is v0.2.13, released 2026-02-01.

No known vulnerabilities on the latest version of macgirvin/http-message-signer.

No, macgirvin/http-message-signer is actively maintained. Latest release: v0.2.13 (2026-02-01).

DepScope has no curated alternatives for macgirvin/http-message-signer at this time.

macgirvin/http-message-signer is licensed under BSD-3-Clause.

composervv0.2.13

RFC 9421 HTTP Message Signer and Verifier for PSR-7 requests

License BSD-3-Clausepermissive22 versions7 deps

52

/ 100

Health

use with caution

macgirvin/[email protected] low health (52/100) — consider alternatives

Health breakdown0 – 100

15/25

maintenance

0/20

popularity

25/25

security

12/15

maturity

0/15

community

Vulnerabilities

0

none known

Dependencies (7)

API access

Get this data programmatically — free, no authentication.

curl https://depscope.dev/api/check/composer/macgirvin/http-message-signer

Last updated · 2026-02-01T19:54:05+00:00