zf1s/zend-acl

Healthy and usable for dependency adoption, with a long release history, recent maintenance, clear licensing, and organization backing. The main caveats are that only one contributor made the sole commit in the last three months and neither the package nor repository includes tests or a security policy.

Latest 1.16.2

Packagist

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Package scaffolding

A README explains that this is an automatically split package and directs issues and pull requests to the main repository, which makes the missing changelog less concerning. However, tests are absent from both the artifact and repository, leaving a genuine maintenance-quality gap.

Repo bus factor

All one recent commit came from a single contributor, creating concentration risk. Organization ownership provides some handoff capacity, so this is a caution rather than a severe abandonment signal.

Repo commit activity

The repository received one commit in the last three months from one active maintainer. Recent release activity compensates for some of the low commit volume, but the observed maintenance activity remains thin.

Repo issue activity

There were no new or closed issues or pull requests in the last month. This does not show active community discussion, but the absence of activity is less concerning given the package's small, stable scope.

Repo tooling

Composer is used as a build tool, which fits the package ecosystem, but no security scanning tools are configured. For this small library, that is a modest transparency gap rather than a decisive risk.