mediawiki/matomo

The package is small and easy to inspect, with a clear README and limited runtime dependencies. Its workflow lacks pinned actions, and the registry has seen no release in nearly three years. The repository is still unarchived and was pushed recently, which partly offsets the stale release cadence.

Latest v5.0.0

Packagist

68%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Are you affected? Scan for Free

Health Score Breakdown

Project backing

The source repository is owned by an individual rather than an organization, so the project has no demonstrated organizational backing to offset its thin activity.

Release history

The latest registry release was published on October 27, 2023, with no releases in the last 12 months. This weakens confidence in compatibility maintenance, although the repository was pushed recently.

Repo commit activity

The repository recorded zero commits and zero active maintainers during the last three months. The recent push date is compensating evidence, but it does not establish sustained maintenance.

Repo issue activity

There were no new or closed issues and no new or merged pull requests in the last month, while seven issues and five pull requests remain open. This suggests limited current project activity.

Repo tooling

The project uses Composer build tooling, but no security-scanning tool was detected. For a small extension this is a modest transparency and maintenance gap.

Vulnerabilities

Title	Versions	Severity
CVE-2017-20175 mediawiki/matomo is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.0.0 - 2.4.3.	0.0.0 - 2.4.3	Medium