Package Health/cromero/composer-mr-patches-commit-lock

cromero/composer-mr-patches-commit-lock

This is a newly published, stable-major Composer plugin with a clear README, a small focused source tree, an explicit BSD-3-Clause license, no install-time lifecycle scripts, and a repository that matches the package and references it. However, the package is effectively brand new, with only two releases on the assessment date, no three-month commit history, no tests or changelog, no security scanning, and a single individual maintainer. These limitations make maintenance maturity and long-term reliability difficult to establish, so the package is usable but should be adopted with additional review and version pinning.

Latest 2.0.0

Packagist

58%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Maintainers

Only one registry maintainer account, Cromero, is listed. The linked repository is owned by an individual rather than an organization, so there is little evidence of maintainer redundancy or continuity.

Package scaffolding

A substantial README documents the plugin's purpose and usage, but both the artifact and repository lack tests and a changelog. For a small plugin this is a meaningful maturity gap because no provided evidence compensates for it.

Project backing

The repository is backed by an individual GitHub user rather than an organization, providing no organizational continuity signal. This is consistent with the single-maintainer profile and increases reliance on one person.

Release history

Only two releases exist and the package age is 0 days, so there is no meaningful release track record yet. The latest release was published shortly before assessment, which indicates current activity but does not compensate for the lack of historical evidence.

Repo commit activity

The repository records zero commits in the last three months and zero active maintainers for that period. Because the project is brand new, this is partly explained by its age, but it still leaves maintenance capacity unproven.