zoglo/contao-collection-widget
This is a small, coherent, apparently maintained package with an MIT license, a matching repository, a recent push, stable versioning, and no deprecation or dangerous workflow indicators. However, it is relatively young at 234 days, has only three releases, just one commit from one contributor in the last three months, and lacks tests, a changelog, security scanning, and a security policy. It appears usable for a narrowly scoped dependency, but its limited maintenance depth and project hygiene warrant caution for critical applications.
68%
Total Score
60
100
78
90
Health Score Breakdown
Only one registry account has publish access. This is a modest resilience concern for an independently owned package, though registry access records do not establish actual maintenance activity.
A readable 1,541-character README documents installation and configuration, but neither the artifact nor repository contains tests or a changelog. For a small bundle this is a genuine, though moderate, transparency and maintenance gap.
The repository is owned by the user account "zoglo", not an organization, so there is no organizational backing to compensate for the concentrated maintainer base.
Three releases over 234 days, with a median interval of about 117 days, show some release continuity but provide only a short and relatively sparse maintenance history.
All recent commits came from a single contributor, leaving the project dependent on one maintainer and creating a meaningful continuity risk.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 Sebastian Zoglowek |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 symfony/asset Version ^7.4 || ^8.1 | — | — |
contao/core-bundle Version ^5.7 || ^6.0 | — | — |
symfony/http-kernel Version ^7.4 || ^8.1 | — | — |
symfony/event-dispatcher Version ^7.4 || ^8.1 | — | — |
symfony/dependency-injection Version ^7.4 || ^8.1 | — | — |
Weekly Downloads
Info
- Last Published
- 1 month ago
- Created
- 8 months ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.