cleup/filesystem

This is a usable, actively maintained Composer package with a clear MIT license, stable 1.1.5 release, recent publishing activity, a non-archived matching repository, and no install-time lifecycle scripts or dangerous workflows. However, maintenance is concentrated entirely in one contributor, the repository has no tests or changelog, has no security policy or scanning tooling, and has essentially no adoption signals (zero stars and forks). It is reasonable for a bounded dependency, but the thin maintainer and validation base warrants caution for critical infrastructure.

Latest 1.1.5

Packagist

68%

Total Score

Maintainer Stability

Dependencies

Maturity

Supply Chain

Health Score Breakdown

Dependency profile

Five runtime requirements, including PHP extensions and established filesystem-related libraries, create some environment and transitive-dependency surface but do not indicate an unusually broad dependency footprint.

Maintainers

Only one registry account has publish access. This is a real publishing continuity concern, although the linked repository shows recent activity by the same owner.

Package scaffolding

A README is present and the repository uses GitHub Releases, but neither the artifact nor repository contains tests or a changelog; for a filesystem library, the absence of repository tests is a meaningful maintenance and regression risk.

Project backing

The repository is owned by an individual user, not an organization, so the single-maintainer concentration is not compensated by an evident organizational handoff structure.

Repo bus factor

One contributor made all 6 recent commits, producing a 100% top-contributor share and a high single-person continuity risk. The repository is user-owned rather than organization-backed, so there is no provided project-backing signal to offset this concentration.