udir-moodle/qtype_wq

This release appears usable but warrants caution before becoming a critical dependency. It has a declared GPL-3.0-or-later license, complete README/tests/changelog scaffolding, a substantial 515-file tree, stable non-prerelease versioning, no registry deprecation, and an unarchived organization-owned repository that was pushed very recently. However, the package is young at 78 days, repository activity over the last 3 months consists of only one commit from one contributor, and the repository has no security policy or security scanning while its update workflow has top-level write permissions. The organization backing partly mitigates the concentrated bus factor, but the limited observed maintenance history and security-hygiene gaps make this a moderate-risk dependency rather than a clearly mature one.

Latest 2026090200

Packagist

68%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package is only 78 days old with four releases and a median interval of about 34 days, providing some release continuity but limited evidence of long-term maintenance maturity.

Repo bus factor

All three-month commit activity is concentrated in one contributor, which is a maintenance risk; the organization-owned repository partly compensates because maintenance can potentially be handed off internally.

Repo commit activity

Only one commit was made in the last 3 months by one active maintainer, indicating limited observed maintenance activity despite the very recent push.

Repo issue activity

There are no open issues or pull requests and no issue or pull-request activity in the last month; this is ambiguous because it may reflect a quiet project rather than abandonment, so it is only a modest concern.

Repo popularity

The repository has zero stars, forks, and watchers. This is weak supporting evidence, but popularity alone is not decisive for an organization-owned package.