youwe/composer-dependency-installer

This is a small, established Composer package with a release history spanning about 9 years, a stable 2.1.0 release, clear MIT licensing, complete artifact scaffolding, tests, changelog, and a repository that matches and documents the package. It is not deprecated or archived, and its organization-backed ownership and recent release indicate ongoing support. However, the repository recorded no commits or active maintainers in the last 3 months, has no security scanning or security policy, and has very low adoption metrics, so maintenance continuity and security-process transparency are weaker than ideal. Overall, it appears suitable to depend on with moderate caution, especially if the package is not business-critical.

Latest 2.1.0Packagist

Health Score Breakdown

Repo commit activitycaution

No commits or active maintainers were recorded in the last 3 months, which weakens evidence of sustained maintenance; the recent release and merged pull request provide only partial compensation.

Repo popularitycaution

The repository has zero stars and watchers and only two forks, indicating limited external adoption and community visibility; this is supporting caution rather than evidence of abandonment on its own.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools are configured, leaving a security-process transparency gap.

Security policycaution

The repository has no security policy, reducing transparency around vulnerability reporting and response expectations for dependents.

View all 19 health checks

Vulnerabilities

We didn't find any vulnerabilities for this package.

Maintainers

Youwe

Klaas Sangers

Jan-Marten de Boer