nextdeveloper/agenda

This release appears generally suitable to depend on: it has a clear MIT license, a substantial and coherent package tree, tests in both the artifact context and repository, regular release activity over more than two years, no deprecation, and an active non-archived repository owned by an organization. The main concerns are that recent repository work is limited to 2 commits from a single maintainer, the project remains on the 0.2.x line, there is no changelog or security policy, and no security-scanning tooling was detected. These issues warrant monitoring and version pinning, but the observed release cadence, repository backing, and recent pull-request activity compensate for the limited recent commit diversity.

Latest v0.2.16

Packagist

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo bus factor

One contributor made all 2 commits in the last 3 months, producing a 100% top-contributor share. Organization ownership provides some handoff capacity, but recent activity remains highly concentrated.

Repo commit activity

Only 2 commits were recorded in the last 3 months, showing limited recent direct commit activity. The six merged pull requests provide some compensating evidence, but the recent implementation activity is still thin.

Repo popularity

The repository has zero stars, forks, and watchers, so there is little evidence of external adoption or community visibility. Popularity is supporting evidence only, and the package's release and maintenance signals provide stronger evidence here.

Repo tooling

Composer build tooling is present, but no security-scanning tools were detected. The missing scanning layer is a transparency and maintenance-hygiene gap, though it is not by itself evidence that the package is unsafe.

Security policy

The repository has no security policy. For a library handling calendars, contacts, tasks, and external calendar subscriptions, this reduces the transparency of vulnerability-reporting and response processes.