getpop/comments

This release shows strong evidence of active, mature maintenance: the package has existed since 2021, has 162 releases including 33 in the last 12 months, was released recently, is stable, has a matching and explicitly referenced source repository, includes tests and a license, and has no install-time scripts or dangerous workflows. However, Packagist marks the package as abandoned and identifies pop-schema/comments as its replacement, which is a major dependency risk even though the repository is still active; maintenance is also concentrated entirely in one contributor and the repository has no security scanning or security policy. Prefer the replacement package for new dependencies unless compatibility requires this package.

Latest 19.2.4

Packagist

35%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Registry deprecation

Packagist marks the package abandoned and provides pop-schema/comments as a replacement. This is a severe adoption and continuity risk despite the recent release activity.

Repo bus factor

All 15 recent commits came from one contributor, giving a complete single-person commit concentration. This lowers resilience if that contributor stops maintaining the project.

Repo popularity

The repository has only 1 star, 0 forks, and 1 watcher. Low popularity is supporting caution rather than a decisive problem, since release and commit activity are strong.

Repo tooling

Composer is used as a build tool, but no security-scanning tools are detected. The missing scanning reduces supply-chain transparency, though it is not by itself evidence of unsafe code.

Security policy

No repository security policy was found. This is a genuine disclosure-process gap for a package intended to be depended on.