babdev/pagerfanta

This release is mature and transparently backed by a matching, non-archived organizational repository, with a long release history, a stable major version, recent releases, repository tests and changelog coverage, a modest dependency footprint, and no observed dangerous workflow patterns. However, Packagist marks the package as abandoned and identifies pagerfanta/pagerfanta as its replacement, which is a decisive adoption concern despite the repository remaining active; recent activity is also limited to two commits from one contributor, and the workflows lack explicit top-level token permissions. Developers should prefer the replacement package unless compatibility requirements specifically require this package.

Latest v4.9.0

Packagist

45%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Registry deprecation

Packagist marks the package as deprecated via packagist_abandoned and names pagerfanta/pagerfanta as a replacement. This is a severe supply-chain maintenance concern for new dependencies, even though other signals show the source repository is still active.

Maintainers

Only one account has registry publishing access. This is a limited publishing control base, but the organization-owned repository provides some compensating project backing and registry access does not establish who actively maintains the code.

Repo bus factor

All 2 recent commits came from one contributor, giving a 100% top-contributor share. Organizational backing provides some handoff capacity, but observed recent activity remains concentrated.

Repo commit activity

The repository recorded 2 commits in the last 3 months from 1 active maintainer. This demonstrates some activity but indicates a very low recent maintenance rate.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected. The missing scanning is a transparency and defense-in-depth gap, not by itself evidence that the package is unsafe.