Package Health/gozi/contao-alias-redirect

gozi/contao-alias-redirect

This release has a coherent, directly linked source repository, a stable v1.0.2 version, a declared LGPL-3.0-or-later license, tests, documentation, a small dependency surface, and no deprecation or archived-repository indicators. However, it is extremely new, with all three releases published within roughly 40 minutes, so maintenance capacity and long-term stability are unproven; the repository also has no security scanning or security policy and has no recorded commit activity beyond its initial publication. It is reasonable to evaluate for adoption with normal dependency and update monitoring, but it does not yet have the track record or transparency practices of a mature dependency.

Latest v1.0.2

Packagist

70%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Project backing

The repository is owned by a user account rather than an organization, so institutional backing is not demonstrated. The package's directly matching repository and matching package mention provide some compensation, but long-term ownership capacity remains uncertain.

Release history

The package is effectively brand new: three releases exist and the latest was published on the same day, with a median interval of about 20 minutes. This provides too little history to demonstrate sustained maintenance or release discipline.

Repo commit activity

There are zero commits and zero active maintainers in the last three months, but the package itself is only hours old, so this cannot yet distinguish abandonment from initial publication. It nevertheless leaves ongoing maintenance unproven.

Repo popularity

The repository has zero stars, forks, and watchers. For a package released only moments earlier this is weak evidence rather than a severe concern, but it offers no external adoption signal.

Repo tooling

Composer is used as the build tool, but no security scanning tools are configured. The missing scanning is a genuine transparency and maintenance gap, though it is not by itself evidence that the package is unsafe.