aura/dispatcher

aura/dispatcher 2.0.5 appears suitable for dependency use: it is a long-established, stable-major package with a current release, a non-deprecated and non-archived repository, a clear BSD-2-Clause license, tests, changelog, README, a small runtime dependency surface, and no install-time lifecycle scripts. The main concerns are the absence of observed commits or active maintainers in the last 3 months, limited popularity, and incomplete repository security hygiene such as no security policy and unspecified workflow token permissions. These concerns warrant monitoring, but the package’s maturity, maintained organizational repository, and strong artifact structure keep it in the healthy range.

Latest 2.0.5

Packagist

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has existed for roughly 12 years with 7 releases and one release in the last 12 months. The long history is positive, although the relatively sparse release cadence limits evidence of sustained recent development.

Repo commit activity

There were zero commits and zero active maintainers during the last 3 months, which is a meaningful maintenance concern. The recent repository push and release history partially offset, but do not remove, the risk of slowing activity.

Repo popularity

The repository has 36 stars, 8 forks, and 13 watchers. This is modest adoption, but popularity is supporting evidence rather than a requirement for a small stable library.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected, leaving a modest security-process gap.

Security policy

No repository security policy was found, reducing transparency about vulnerability reporting and response procedures. This is a hygiene gap rather than evidence that the package is unsafe.