mautic/core

mautic/core 7.2.0 presents a strong dependency-health profile: it has a long release history, frequent recent releases, a stable major version, active non-archived organization-backed development, substantial recent commit and pull-request activity, and a broad contributor base. Licensing, tests, repository tooling, security policy, and workflow analysis are also reassuring. The main caveats are install-time lifecycle scripts, several workflows without top-level token permissions, and the linked repository not explicitly naming this package; the latter may be explained by the package being part of a monorepo, but it reduces provenance clarity. Overall, the available evidence supports adoption, with normal supply-chain review of Composer scripts and package provenance still advisable.

Latest 7.2.0Packagist

Health Score Breakdown

Lifecycle scriptscaution

post-install-cmd and post-update-cmd scripts introduce install-time execution and therefore deserve review, although lifecycle hooks are not by themselves evidence of poor maintenance.

Repo package mentioncaution

The repository name does not match mautic/core and its README does not mention the package, which weakens direct package-to-repository provenance; this may be expected for a monorepo but remains a transparency caution.

Token permissionscaution

Nine workflows declare read-only permissions, but four lack top-level permissions and two declare top-level write access, leaving some workflow permission hardening gaps.

View all 19 health checks

Direct Dependencies

Dependency	Last Release	Score
mautic/core-lib Version ^7.0	—	—
composer/installers Version ^2.3	—	—
cweagans/composer-patches Version ^1.7.3	—	—