wikimedia/clover-diff

The repository is organization-owned, licensed, and has tests, but registry releases have stopped for over a year and recent commit activity is concentrated in one contributor. The package is stable and not deprecated, which reduces—but does not remove—the adoption risk.

Latest v2.0.2

Packagist

45%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Name lookalike

The package is flagged as borrowing the identity of wikimedia/composer-merge-plugin, which has far more downloads; the absence of artifact overlap does not offset the explicit identity signal. Consumers may have intended the established lookalike instead.

Release history

There have been no releases in the last 12 months, and the latest registry release was over a year ago. One recent repository commit provides some evidence of activity but does not restore release cadence.

Repo bus factor

All recent repository commits came from one contributor, creating a thin effective maintainer base. Organization ownership provides some handoff capacity, but no second active contributor is shown.

Repo commit activity

Only one commit was recorded in the last three months, indicating limited recent maintenance even though the repository was updated recently.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected. For this small PHP utility, the missing scanning is a hygiene gap rather than a severe health concern.