gathercontent/client

This release appears suitable to depend on from a maintenance and transparency perspective: it is a stable major release, has recent release activity, is not deprecated or archived, includes a license, README, tests, and a conventional Composer build setup, and is backed by an organization-owned repository. The main concerns are that all three commits in the last three months came from one contributor, the repository has no security policy, and its GitHub Actions workflow does not declare top-level token permissions. Low popularity is only supporting context and does not outweigh the recent release and repository activity. Overall, the package is healthy but would benefit from a broader active maintainer base and stronger repository security hygiene.

Latest 1.2.2

Packagist

80%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo bus factor

All three recent commits came from one contributor, creating concentration risk; organization ownership provides some capacity for handoff but does not remove the observed single-contributor exposure.

Repo popularity

The repository has only one star and three forks, indicating limited public adoption; this is supporting context rather than a decisive concern because recent releases and organization backing are present.

Repo tooling

Composer and Robo are used as build tools, supporting structured project maintenance, but no security scanning tools were detected.

Security policy

No repository security policy was found, leaving vulnerability-reporting and response expectations undocumented.

Token permissions

The only analyzed workflow lacks top-level token permissions, so its effective permissions are not explicitly minimized in the repository configuration.