Package Health/raoul2000/yii2-jcrop-widget

raoul2000/yii2-jcrop-widget

The package is small and clearly identified, with a license, README, and no install-time scripts. Its release and repository activity stopped years ago, while the single-maintainer project has no security policy or scanning; pinning it should be treated as a long-term maintenance risk.

Latest 1.0.0

Packagist

40%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has had only one release, published about 12 years ago, with no releases in the past 12 months. This is strong evidence of abandonment risk for a dependency.

Repo commit activity

There were no commits and no active maintainers in the last three months. This confirms that the long release gap reflects inactive development rather than merely an infrequent release schedule.

Maintainers

Only one registry publishing maintainer is listed. That is a thin operational base for a user-owned project and increases continuity risk when combined with the absence of recent activity.

Project backing

The package and repository are owned by the same individual account, with no organization backing shown. This is consistent with the single-maintainer risk and provides no redundancy for continued maintenance.

Repo tooling

Composer is used for the build, but no security scanning tools are configured. The missing scanning is a modest hygiene gap, not a standalone reason to reject the package.