weareplanet/magento-2

This release appears suitable to depend on, with strong evidence of active and structured maintenance: 47 releases over roughly 3 years, 15 releases in the last 12 months, a stable major version, a current unarchived repository, organization backing, and recent publication activity. The main concerns are concentrated recent development in one contributor, low repository popularity, no repository tests or changelog, no security policy, and limited issue-resolution activity; these lower resilience and transparency but do not indicate abandonment. The package is licensed, has no install-time lifecycle scripts, uses Composer and security scanning, and directly matches its source repository.

Latest 3.5.0

Packagist

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Package scaffolding

A substantive README is present and documents requirements and supported versions, but neither the artifact nor repository contains tests or a changelog. The missing tests and changelog are genuine transparency and maintenance gaps for a payment integration, although GitHub Releases provide some release-process compensation.

Repo bus factor

All five recent commits came from one contributor, creating a meaningful continuity risk. Organization ownership provides some capacity to hand maintenance off, but no second active contributor is shown.

Repo issue activity

There are six open issues and one open pull request, with two new issues in the last month but no issues or pull requests closed or merged during that period. This suggests some responsiveness concern, though recent commits and releases show the project is not inactive.

Repo popularity

The repository has zero stars, two forks, and four watchers, indicating limited public adoption or visibility. Popularity is supporting evidence rather than a decisive health measure, so this is a modest concern given the strong release activity.

Security policy

No security policy was found in the repository, which is a transparency gap for a payment-processing extension. The presence of Sonar scanning is helpful but does not replace a vulnerability-reporting policy.