getpop/definitions

This is a healthy, actively maintained release with a six-year history, 176 releases, 33 releases in the last 12 months, and a recent stable release. The repository is not archived, matches the package and references it in its README, includes tests, and is backed by an organization. The main risks are that all recent commits come from one contributor, the repository has very low public popularity, and no dedicated security scanning or security policy was detected; these are meaningful transparency and continuity gaps but do not outweigh the strong release and maintenance evidence.

Latest 19.2.4

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Maintainers

Only one registry account has publish access, which is a continuity concern; however, the linked repository is organization-owned and the release history shows active ongoing publishing, partly compensating for the narrow registry access base.

Repo bus factor

One contributor made 100% of the 14 commits in the last 3 months, creating concentration risk. Organization ownership provides some ability to hand maintenance off, so this is caution rather than danger.

Repo commit activity

The repository recorded 14 commits in the last 3 months, showing current maintenance, but all were made by one active maintainer.

Repo popularity

The repository has only 2 stars, 0 forks, and 1 watcher. This indicates limited public adoption or visibility, but popularity is supporting evidence rather than a health verdict and is outweighed by active releases and commits.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected. The missing security automation is a modest supply-chain hygiene gap rather than evidence of abandonment.