sypets/brofix

This is a healthy, actively maintained release with a five-year history, 65 releases, eight releases in the last 12 months, a stable version, recent repository activity, clear licensing, substantial source and documentation, and repository tests and CI. The main risks are concentration of recent development in one contributor, a sizeable backlog of open issues, and missing security-policy and explicit workflow token-permission declarations. These are meaningful resilience and governance cautions, but the active release cadence, non-archived matching repository, and clean workflow-risk profile make the package reasonable to depend on with normal operational review.

Latest v8.1.1

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Lifecycle scripts

The package uses a post-autoload-dump lifecycle script. This adds install-time execution surface, but the provided signal does not indicate a dangerous script or malicious behavior.

Maintainers

Only one registry maintainer account is listed. Because the repository is user-owned rather than organization-owned, this represents some publishing continuity risk, although repository activity shows the maintainer is currently active.

Project backing

The source repository is owned by the individual user sypets rather than an organization. This does not indicate poor health, but it means there is no demonstrated organizational maintenance redundancy to offset contributor concentration.

Repo bus factor

All 14 commits in the last 3 months came from one contributor, producing a concentrated bus factor. This is a resilience concern for a user-owned project because loss of that contributor could slow maintenance or releases.

Repo issue activity

There are 59 open issues, with 1 new issue and no issues closed in the last month, while 2 pull requests were merged. The backlog and limited recent issue closure are a maintenance concern, though merges show some ongoing activity.

Vulnerabilities

We didn't find any vulnerabilities for this package.

Package versions

Maintainers

Sybille Peters

Direct Dependencies

Dependency	Last Release	Score
typo3/cms-core Version ^13.4 \|\| ^14.3	—	—
typo3/cms-fluid Version ^13.4 \|\| ^14.3	—	—
typo3/cms-backend Version ^13.4 \|\| ^14.3	—	—
typo3/cms-install Version ^13.4 \|\| ^14.3	—	—
stayallive/certificate-chain-resolver Version ^1.0	—	—