composer/composer
Dependency Manager for PHP
29.6k stars · 4.8k forks · PHP
Healthy
Healthy: actively maintained by 26 people, no known risks.
Why
No rule fired.
What would change this
- A dormant maintenance status, a deprecated or archived package, a successor link, or a critical advisory would change this.
Maintenance
CompleteActive
- Human commits, 30 days
- 49
- Human commits, 90 days
- 74
- Human commits, 365 days
- 370
- Bot share of commits, 365 days
- 10%
- Last commit
- Oct 8, 2026 (6 days ago)
- Last human commit
- Oct 8, 2026 (6 days ago)
- Authors, 90 days
- 26
- Last release
- Aug 27, 2026 (1 month ago)
- Median PR merge time
- 31 hours
Responsiveness: of 29 recent issues, 72% got a maintainer reply. Median first response: 28 hours.
Sources: Commits, Releases, Merged pull requests, Issues
People
Complete- Owner
- Organization
- Commits sampled
- 370 since Oct 14, 2025
- Authors for half of commits
- 1
- Authors for 80% of commits
- 7
- Contributors
- 382
Top committers
- Seldaek: 64% of commits
- glaubinix: 9% of commits
- naderman: 3% of commits
- eyupcanakman: 2% of commits
- Toflar: 1% of commits
Sources: Commits, Contributors
Stars
CompleteOrganic, confidence high
Bursts
- Dec 2, 2014 to Dec 4, 2014: about 192 more stars than usual, peak 142 in one day, a spike that tapers off. Outside explanation: a jump in forks, a jump in issues and pull requests.
- Apr 5, 2016 to Apr 7, 2016: about 59 more stars than usual, peak 33 in one day, a spike that tapers off. Outside explanation: a jump in forks, a jump in issues and pull requests.
- Mar 27, 2017 to Mar 29, 2017: about 53 more stars than usual, peak 28 in one day, a spike that tapers off. Outside explanation: a jump in forks.
- Dec 21, 2017 to Dec 23, 2017: about 277 more stars than usual, peak 194 in one day, a spike that tapers off. No outside explanation found, so this burst is unexplained.
- Jan 4, 2018 to Jan 11, 2018: about 222 more stars than usual, peak 58 in one day, a spike that tapers off. Outside explanation: a jump in issues and pull requests.
- 1.1k stars on a repo created before February 2013 have no date, so they aren't in the chart.
Anyone can buy stars for any repo; bursts alone don't prove the owner did.
- The star history looks organic.
- 1105 stars on the creation day are undated (before 2013-02-10) and are not counted.
Sources: How star history is analyzed
Risk
CompleteFlags
No risk flags.
License
- Now
- MIT (OSI-approved)
- A year ago
- MIT (OSI-approved)
Packages
No published packages found.
OpenSSF Scorecard: 6.3 out of 10 (via deps.dev).
Sources: GitHub: composer/composer
Badge
Add this to a README to show the current verdict:
[](https://reporadar.ai/composer/composer)Earlier verdicts
- Oct 14, 2026: Healthy
- Oct 14, 2026: Healthy
Computed 10 hours ago · method 2026.10.2