getpop/meta

This release has strong evidence of active maintenance and reasonable package hygiene: it has a five-year release history with 33 releases in the last 12 months, a stable version, an active non-archived repository, tests, a clear license, and no install-time lifecycle scripts. However, Packagist marks the package as abandoned and identifies pop-schema/meta as its replacement, which is a major dependency risk even though the repository was pushed recently. Maintenance is also concentrated in one contributor, and the repository has no security scanning or security policy. Developers should prefer the replacement package unless compatibility requirements make this package necessary.

Latest 19.2.4

Packagist

42%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Registry deprecation

Packagist marks the package as abandoned and names pop-schema/meta as the replacement. This is a severe lifecycle and adoption risk that outweighs the otherwise healthy maintenance evidence.

Repo bus factor

One contributor made all 17 commits in the last 3 months, creating a concentrated bus factor. Organization ownership provides some handoff capacity, but no second active contributor is shown.

Repo popularity

The repository has 2 stars, 0 forks, and 1 watcher, indicating limited adoption. Popularity is supporting evidence only, so this lowers confidence in ecosystem maturity modestly but is not decisive.

Repo tooling

Composer is used as a build tool, but no security scanning tools are detected. The missing scanning is a security-hygiene gap, though it is not by itself evidence that the package is unsafe.

Security policy

The repository has no security policy. That reduces vulnerability-reporting transparency and response expectations.