Package Health/getpop/mandatory-directives-by-configuration

getpop/mandatory-directives-by-configuration

This is a mature, actively released, stable package with 162 releases over roughly 5 years, 33 releases in the last 12 months, a recent release, an unarchived repository, a clear GPL license, tests, and a direct repository/package match. The organization-owned repository provides useful project backing despite one active contributor, which reduces but does not eliminate bus-factor risk. The main concerns are complete contributor concentration, no repository security policy or security scanning, and no changelog detected in either the artifact or repository; these are meaningful transparency and resilience gaps but do not outweigh the strong release and maintenance evidence.

Latest 19.2.4

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Package scaffolding

The artifact and repository include a README and tests, and the README documents usage, testing, and contribution paths. No changelog was detected in either location, which is a modest transparency gap.

Repo bus factor

All 14 commits in the last 3 months came from one contributor, creating a genuine concentration risk. The organization-owned repository provides some potential handoff capacity, so this is caution rather than a severe standalone risk.

Repo popularity

The repository has only 1 star, 0 forks, and 1 watcher. This is limited supporting evidence of adoption, but popularity is not decisive for a small, actively maintained package.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected. The build setup is appropriate, while the absent scanning is a modest security-process gap.

Security policy

No repository security policy was detected, and the README instead provides an email contact for security reports. The absence of a formal SECURITY.md reduces disclosure transparency but is not an abandonment signal.