Package Health/friends-of-contao/contao-associategroups

friends-of-contao/contao-associategroups

Usable with caveats: this is a small, stable extension with a matching organization-backed repository, clear documentation, and no deprecation. However, it has had no registry release in the past year, no recent commits, and no security scanning or policy.

Latest 1.3.4

Packagist

68%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has existed since 2015 with five releases, but none in the last 12 months and a long median interval of about 794 days indicate slow maintenance. Its latest release was still published in May 2025, which partly offsets the concern.

Repo commit activity

There were no commits and no active maintainers in the last three months, a concrete sign that maintenance has currently slowed. The repository's October 2025 push provides some compensating evidence but does not demonstrate ongoing activity.

Repo popularity

The repository has only one star and five forks, indicating a small user base. Popularity is supporting evidence rather than a requirement, so this lowers confidence in broad community scrutiny without making the package unsafe to adopt.

Repo tooling

Composer is used for the build and packaging process, but no security scanning tool is configured. This is a transparency and assurance gap, though the package has no reported dangerous workflows.

Security policy

The repository has no security policy, leaving vulnerability-reporting expectations unclear. This is a genuine transparency gap, but it is less severe for a small, stable extension than archival or deprecation would be.