Package Health/azine/mailgunwebhooks-bundle

azine/mailgunwebhooks-bundle

This is a generally healthy release with a long package history, four releases in the last 12 months, a stable major version, current repository activity, tests, a clear README, an MIT license, and no deprecation or archived-repository indicators. The main concerns are maintenance concentration in one contributor, absence of repository security scanning and a security policy, and a publish workflow with top-level write permissions; these merit review but do not outweigh the package's active development and substantial project structure.

Latest 5.0.4

Packagist

82%

Total Score

Maintainer Stability

Dependencies

Maturity

Supply Chain

Health Score Breakdown

Dependency profile

The package declares 24 runtime dependencies, including several Symfony, Doctrine, and extension requirements. This is a meaningful integration surface and increases compatibility and maintenance burden, but the dependencies are explicit rather than hidden.

Project backing

The repository owner is a GitHub User rather than an organization, so there is no provided organization-backing evidence to offset the concentrated contributor activity.

Repo bus factor

One contributor made all 6 commits in the last 3 months, giving a 100% top-contributor share. This creates a genuine continuity risk because the project is user-owned rather than organization-backed.

Repo tooling

Composer is used as a build tool, but no security scanning tool is configured. The absence of scanning is a hygiene gap, though it is not evidence of a malicious package.

Security policy

The repository has no SECURITY.md or other security policy, leaving vulnerability reporting and disclosure expectations unspecified.