ostashevdv/yii2-image

The package is small and clearly identified, with a usable README, declared license, and no install-time scripts. Its maintenance and security evidence are too thin for a dependable current dependency, so pinning this old release carries substantial risk.

Latest 2.0.1

Packagist

38%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has had no registry release in more than 11 years, with only four releases overall; this is strong evidence of abandonment for a library dependency.

Repo commit activity

There were zero commits and zero active maintainers in the last 3 months, consistent with the repository's long period without updates and materially increasing maintenance risk.

Package file tree

The artifact and repository each contain only README.md, composer.json, and one source file. This is not inherently unsafe for a small wrapper, but it provides little evidence of testing or ongoing project depth.

Project backing

The package and repository are owned by the same individual account. This is coherent ownership, but it provides no organizational backing to offset a single-person maintenance base.

Repo popularity

The repository has only 2 stars and 6 forks. Popularity is supporting evidence rather than a verdict, but these low adoption signals provide little compensating evidence for its inactivity.