getpop/api

This is a mature and actively maintained release: the package has existed for about 5 years, has 162 releases including 33 in the last 12 months, publishes a stable non-prerelease version, and was updated very recently. The artifact is well documented, contains tests and a substantial source tree, has a clear GPL-2.0-or-later license, uses no install-time lifecycle scripts, and is backed by a matching organization-owned repository. The main concerns are that recent commit activity is concentrated entirely in one contributor, the repository has very low popularity, and it has no security policy or security-scanning tooling; these reduce resilience and transparency but do not outweigh the strong release and maintenance history.

Latest 19.2.4

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Maintainers

Only one registry account has publish access, which is a publishing resilience concern, although the matching organization-owned repository provides some project-level backing.

Repo bus factor

All 15 recent commits came from one contributor, creating concentration risk. Because the repository is organization-owned, maintenance can potentially be handed off, so this is a caution rather than a severe risk.

Repo issue activity

There were no new or merged pull requests and no issue activity in the last month, which provides little evidence of broader community engagement; the null open-issue count is unknown rather than negative.

Repo popularity

The repository has only 2 stars, 0 forks, and 2 watchers. This is weak supporting evidence, but popularity is not decisive given the strong release and commit activity.

Repo tooling

Composer build tooling is present, but no security-scanning tools were detected, leaving a security-hygiene gap.