getpop/root

This is a healthy, mature release with more than six years of history, 183 releases, 33 releases in the last 12 months, and a current stable version. The linked repository is active, unarchived, clearly matches the package, has tests, and is backed by an organization, while the package is licensed and uses no install-time lifecycle scripts. The main concerns are that all 19 commits in the last three months came from one contributor, the repository has no security scanning or security policy, and repository popularity is very low; these reduce resilience and transparency but do not outweigh the strong release and maintenance record.

Latest 19.2.4

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo bus factor

One contributor made all 19 commits in the last three months, creating a genuine concentration risk. Organization ownership provides some handoff capacity, but no second recently active contributor is shown.

Repo popularity

The repository has only 1 star, 1 fork, and 1 watcher, so there is little community visibility or external validation. Popularity is supporting evidence rather than a verdict, so this is a caution rather than a severe risk.

Repo tooling

Composer build tooling is present, but no security scanning tools are configured. The missing scanning reduces security-process transparency, although it is not evidence that the package is unsafe.

Security policy

The repository has no SECURITY.md or other detected security policy, leaving vulnerability-reporting and response expectations undocumented.

Vulnerabilities

We didn't find any vulnerabilities for this package.

Package versions

Maintainers

Leonardo Losoviz

Direct Dependencies

Dependency	Last Release	Score
symfony/yaml Version ^6.0	—	—
symfony/config Version ^6.0	—	—
symfony/dotenv Version ^6.0	—	—
symfony/finder Version ^6.0	—	—
pop-backbone/php-hooks Version ^19.2.4	—	—